CVE-2024-21623 CRITICAL

CVE-2024-21623: Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets

Vendor Mehah
Product otclient
Weakness CWE-74
Published January 2, 2024
Last update November 14, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow. Commit db560de0b56476c87a2f967466407939196dd254 contains a fix for this issue.

Key dates

02Disclosure timeline

January 2, 2024 CVE published
November 14, 2024 Record updated