地图 / Improper handling of null bytes in GitHub Actions Runner allows an attacker to set arbitrary environment variables

Improper handling of null bytes in GitHub Actions Runner allows an attacker to set arbitrary environment variables

注入与走私 / 资源注入 / #1762025

厂商: GitHub
严重程度: 低危
赏金: —
弱点: 资源注入
研究员: @ryotak
披露日期: 2023-03-09
资产: github.com
CVE: CVE-2023-22381

该报告还没有中文解读。

时间线

2022-11-04报告提交
2023-03-09公开披露

阅读 HackerOne 原文 ↗作者 @ryotak · 版权归作者与 GitHub 所有

同类报告

Arbitrary local system file read on open-xchange serverOpen-Xchange · — · $2,000 Nextcloud Desktop Client RCE via malicious URI schemesNextcloud · 2021-04-15 · $1,000 [Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotelyNintendo · 2025-05-15 HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressGitLab · 2024-10-08 · $1,060 Content injection in Jira issue title enabling sending arbitrary POST request as victimGitLab · 2022-09-22 Arbitrary POST request as victim user from HTML injection in Jupyter notebooksGitLab · 2022-05-20