Cloudanix VulnDB

CVE-2024-54132

None

CVSS

—

EPSS

0.6%

Published

Dec 4, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the GitHub command-line tool lets attackers place files into the wrong folders when someone downloads a specially named workflow file, which could let them change or damage files on the computer.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Tampering
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Path traversal via artifact name ".." causes gh run download to extract files one directory above the --dir target, enabling creation or overwrite outside the intended path.

Why it matters to the business

Attackers can tamper with files in parent directories on developer or CI machines, risking workflow integrity, data corruption, or supply-chain compromise when users download untrusted artifacts.

How an attack unfolds

An attacker uploads a GitHub Actions workflow artifact deliberately named ".." containing malicious files; a victim then runs gh run download --dir <target> against the run, causing the CLI to resolve the artifact name and place extracted contents one level higher than specified, writing files outside the intended directory.

How to fix it

Upgrade GitHub CLI (cli/cli) to version 2.63.1 or commit 1136764c369aaf0cae4ec2ee09dc35d871076932; for node-send on Ubuntu 20.04 upgrade to 0.16.2-1.

How to confirm the fix worked

Run `gh --version` and confirm output shows 2.63.1 or newer; test download of an artifact named ".." in an isolated environment and verify files remain inside the --dir target only.

Typical attack path

  1. Craft and upload a workflow artifact named ".." containing chosen files
  2. Publish or share a workflow run containing the artifact
  3. Victim executes gh run download with a --dir flag
  4. CLI resolves the artifact name against the flag and writes files one directory higher

How to detect it

Review shell history and CI logs for invocations of gh run download; inspect file timestamps and paths for artifacts that appear one level above expected download directories; correlate with workflow run IDs that contain artifacts named "..".

What your security team should do

  • Immediately upgrade all GitHub CLI installations to 2.63.1
  • Audit recent gh run download usage in CI and developer scripts for --dir arguments
  • Restrict workflow artifact names in organization repositories to block ". ." patterns
  • Monitor for unexpected file modifications in parent directories of download targets

The record

The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/cli/cli 0 No fix
Go github.com/cli/cli/v2 0 2.63.1
Chainguard gh 0 2.63.1-r0
Chainguard gh-doc 0 2.63.1-r0
Debian:12 gh 0 No fix
Debian:13 gh 0 No fix
Ubuntu:22.04:LTS gh 0 No fix
Ubuntu:24.04:LTS gh 0 No fix
Ubuntu:24.10 gh 0 No fix
Ubuntu:25.04 gh 0 No fix
Ubuntu:25.10 gh 0 No fix
Ubuntu:Pro:24.04:LTS gh 0 No fix
Ubuntu:Pro:24.04:LTS gh 0 2.45.0-1ubuntu0.3+esm2
Wolfi gh 0 2.63.1-r0
Wolfi gh-doc 0 2.63.1-r0
go github.com/cli/cli 0 No fix
openSUSE:Tumbleweed govulncheck-vulndb 0 0.0.20241209T183251-1.1

Related vulnerabilities