Executive brief
Projen is a project generation tool that automatically creates and manages configuration files for JavaScript projects, including GitHub Actions workflows. The rebuild-bot workflow was misconfigured to run on pull-request comments with elevated repository permissions, allowing any GitHub user to trigger untrusted code execution in the main repository. On repositories without branch protection, attackers could potentially commit changes or access repository secrets like authentication tokens.
Technical details
The vulnerability is a GitHub Actions workflow misconfiguration (CWE-527) in projen's rebuild-bot.yml workflow. The workflow uses the issue_comment trigger event, which executes with a GITHUB_TOKEN from the target repository (main branch) rather than the source repository (fork). This allows any user to trigger code execution via comments like "@projen rebuild" on pull requests. Combined with missing branch protection on the default branch, an attacker can gain write access to the repository and potentially exfiltrate secrets. The issue was mitigated in version 0.16.41 by removing the issue_comment trigger, and fully resolved in version 0.17.0 which removes the workflow entirely.
Affected products
- Projen projen 0.6.0 to 0.16.40
Timeline
- 2021-04-06: disclosed
- 2021-04-06: patched: Version 0.16.41 removes issue_comment trigger; version 0.17.0 completely removes rebuild-bot.yml workflow