Recently, security researchers have identified a supply-chain vulnerability present in Bazel, one of Google’s key open-source projects. This vulnerability revolves around a command injection flaw found in a GitHub Actions workflow that Bazel depends on, potentially enabling malicious actors to inject harmful code into Bazel’s codebase.
Cycode researchers have highlighted the severity of this issue, as it has the potential to impact numerous projects and users across various platforms, including Kubernetes, Angular, Uber, LinkedIn, Databricks, Dropbox, Nvidia, and even Google itself.From a technical perspective, the focus of this discovery is on GitHub Actions, a platform for continuous integration and continuous delivery (CI/CD). While GitHub Actions enable users to automate build, test, and deployment processes through customizable workflows, the use of Custom Actions introduces complexities and security risks.Cycode’s advisory emphasizes the challenges posed by the extensive dependencies in workflows, especially those utilizing third-party actions. The research delves into the vulnerabilities within indirect dependencies, such as Custom Actions, which may be located in different repositories and ecosystems under various maintainers. The article particularly highlights the risk associated with Composite Actions, which combine multiple workflow steps into one action.The advisory provides insights into the specific vulnerability identified within Bazel’s GitHub Actions workflow, outlining the steps leading to the injection point. Of particular concern is the ability to inject and execute arbitrary commands due to inadequate input validation in Composite Actions.Upon discovering the vulnerability, the Cycode research team promptly reported it through Google’s Vulnerability Reward Program on November 1, 2023, receiving acknowledgment from Google shortly after. Google then took steps to address and resolve the vulnerable components within Bazel by December 5.The necessary fixes, including updates to workflow base permissions and modifications to the dependent action, were implemented, effectively eliminating the command injection vulnerability.
