Potential Script Injection Attack

ID

potential_script_injection_attack

Severity

critical

Resource

Repository

Description

Detects whether an event context data that might be attacker controlled contains a suspicious payload.

This is the list of events that are being inspected by this detector:

  • github.event.issue.title

  • github.event.issue.body

  • github.event.pull_request.title

  • github.event.pull_request.body

  • github.event.comment.body

  • github.event.review.body

  • github.event.pages.*.page_name

  • github.event.commits.*.message

  • github.event.head_commit.message

  • github.event.head_commit.author.email

  • github.event.head_commit.author.name

  • github.event.commits.*.author.email

  • github.event.commits.*.author.name

  • github.event.pull_request.head.ref

  • github.event.pull_request.head.label

  • github.event.pull_request.head.repo.default_branch

  • github.head_ref

See this GitHub Security post to know more about this topic.

Impact

An event context data that might be attacker controlled can have significant impacts on the security of a repository. Here are some potential consequences:

  • Code Injection: Attackers can manipulate the event context data to inject malicious code into the repository. This can lead to the execution of unauthorized commands, compromising the integrity and security of the repository’s codebase.

  • Unauthorized Access: By controlling the event context data, attackers may attempt to gain unauthorized access to sensitive resources or confidential information within the repository. This can result in data breaches, intellectual property theft, or unauthorized modifications to the repository.

  • Privilege Escalation: Attackers can exploit the event context data to escalate their privileges within the repository. By impersonating privileged users or bypassing security measures, they may gain elevated access rights, allowing them to perform unauthorized actions or compromise other aspects of the repository’s security.

  • Denial-of-Service (DoS) Attacks: Manipulating event context data, attackers can orchestrate DoS attacks by overloading the repository with requests or causing resource exhaustion. This can lead to service disruptions, rendering the repository inaccessible to legitimate users.

  • Code Vulnerabilities: If the event context data is attacker controlled, it may introduce vulnerabilities into the repository’s codebase. This can include adding malicious code snippets or exploiting insecure coding practices, potentially leading to further security issues and compromising the overall security of the repository.

Supported Technologies

This detector is supported by the following sensors:

Azure Sensor  Azure Sensor

GitHub Actions   GitHub Sensor

GitLab Sensor   GitLab Sensor

Jenkins   Jenkins Sensor