CVE-2021-32724

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pull_request_target (or schedule), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN to be exposed. With the GITHUB_TOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. As a workaround users may can either: Disable the workflow until you've fixed all branches or Set repository to Allow specific actions. check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. Set repository Workflow permissions to Read repository contents permission. Workflows using check-spelling/check-spelling@main will get the fix automatically. Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version. Users can verify who and which Pull Requests have been running the action by looking up the spelling.yml action in the Actions tab of their repositories, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml - you can filter PRs by adding ?query=event%3Apull_request_target, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml?query=event%3Apull_request_target.

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pull_request_target (or schedule), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN to be exposed. With the GITHUB_TOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. As a workaround users may can either: Disable the workflow until you've fixed all branches or Set repository to Allow specific actions. check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. Set repository Workflow permissions to Read repository contents permission. Workflows using check-spelling/check-spelling@main will get the fix automatically. Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version. Users can verify who and which Pull Requests have been running the action by looking up the spelling.yml action in the Actions tab of their repositories, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml - you can filter PRs by adding ?query=event%3Apull_request_target, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml?query=event%3Apull_request_target.

Impact

For a repository with the check-spelling action enabled that triggers on pull_request_target (or schedule), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN to be exposed.

With the GITHUB_TOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository.

Workarounds

You can either:

• Disable the workflow until you've fixed all branches.

or

• Set repository to Allow specific actions. You can check:
  • [x] Allow actions created by GitHub
  • [x] Allow Marketplace actions by verified creators

check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses.

or

• Set repository Workflow permissions to Read repository contents permission.

Solution

Workflows using check-spelling/check-spelling@main were fixed automatically with the release of v0.0.19.

Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version.

The simple case

In the simple case, you have few enough open branches that you can do the following on all branches.

• Edit the workflow to use check-spelling/check-spelling@main, or
• Edit the workflow to use check-spelling/check-spelling@v0.0.19, or
• Delete the workflow file, or
• Change the workflow to only use on: push
  • this will result in PRs losing status checks (commits will still have statuses)

The complex case

If you have too many open branches to feasibly fix all of them as per the above, you can instead do the following:

1. Perform the above solution on all open branches for which you need check-spelling to be active.
2. On all open branches on which you need check-spelling to be active, rename the workflow file (e.g. to spelling2.yml)
3. On the default branch, create a dummy workflow file with the old name (this is usually spelling.yml).
4. Use the GitHub Actions UI to disable the workflow with the old name (this is usually spelling.yml).

This should prevent the vulnerable workflow from executing on any branches that you have not applied the proper solution to.

The reason for creating the dummy file (Step 3) before disabling the workflow (Step 4) is that, in our testing, GitHub may un-disable a workflow if it does not exist on your default branch.

Example dummy workflow file (For step 3):

# spelling.yml is disabled per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
name: Workflow should not run!
on:
  push:
    branches: ''

jobs:
  placeholder:
    name: Should be disabled
    runs-on: ubuntu-latest
    if: false
    steps:
    - name: Task
      run: |
        echo 'Running this task would be bad'
        exit 1

You should also include a comment in the new workflow to remind people not to resurrect the old name, for example:

# spelling.yml is disabled per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p

Finally, you should consider sending a Pull Request to an open branch in which you have not performed the proper solution to verify that the old version of…

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pull_request_target (or schedule), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN to be exposed. With the GITHUB_TOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. As a workaround users may can either: Disable the workflow until you've fixed all branches or Set repository to Allow specific actions. check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. Set repository Workflow permissions to Read repository contents permission. Workflows using check-spelling/check-spelling@main will get the fix automatically. Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version. Users can verify who and which Pull Requests have been running the action by looking up the spelling.yml action in the Actions tab of their repositories, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml - you can filter PRs by adding ?query=event%3Apull_request_target, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml?query=event%3Apull_request_target.

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pull_request_target (or schedule), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN to be exposed. With the GITHUB_TOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. As a workaround users may can either: Disable the workflow until you've fixed all branches or Set repository to Allow specific actions. check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. Set repository Workflow permissions to Read repository contents permission. Workflows using check-spelling/check-spelling@main will get the fix automatically. Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version. Users can verify who and which Pull Requests have been running the action by looking up the spelling.yml action in the Actions tab of their repositories, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml - you can filter PRs by adding ?query=event%3Apull_request_target, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml?query=event%3Apull_request_target.

Impact

For a repository with the check-spelling action enabled that triggers on pull_request_target (or schedule), an attacker can send a crafted Pull Request that causes a GITHUB_TOKEN to be exposed.

With the GITHUB_TOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository.

Workarounds

You can either:

• Disable the workflow until you've fixed all branches.

or

• Set repository to Allow specific actions. You can check:
  • [x] Allow actions created by GitHub
  • [x] Allow Marketplace actions by verified creators

check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses.

or

• Set repository Workflow permissions to Read repository contents permission.

Solution

Workflows using check-spelling/check-spelling@main were fixed automatically with the release of v0.0.19.

Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version.

The simple case

In the simple case, you have few enough open branches that you can do the following on all branches.

• Edit the workflow to use check-spelling/check-spelling@main, or
• Edit the workflow to use check-spelling/check-spelling@v0.0.19, or
• Delete the workflow file, or
• Change the workflow to only use on: push
  • this will result in PRs losing status checks (commits will still have statuses)

The complex case

If you have too many open branches to feasibly fix all of them as per the above, you can instead do the following:

1. Perform the above solution on all open branches for which you need check-spelling to be active.
2. On all open branches on which you need check-spelling to be active, rename the workflow file (e.g. to spelling2.yml)
3. On the default branch, create a dummy workflow file with the old name (this is usually spelling.yml).
4. Use the GitHub Actions UI to disable the workflow with the old name (this is usually spelling.yml).

This should prevent the vulnerable workflow from executing on any branches that you have not applied the proper solution to.

The reason for creating the dummy file (Step 3) before disabling the workflow (Step 4) is that, in our testing, GitHub may un-disable a workflow if it does not exist on your default branch.

Example dummy workflow file (For step 3):

# spelling.yml is disabled per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
name: Workflow should not run!
on:
  push:
    branches: ''

jobs:
  placeholder:
    name: Should be disabled
    runs-on: ubuntu-latest
    if: false
    steps:
    - name: Task
      run: |
        echo 'Running this task would be bad'
        exit 1

You should also include a comment in the new workflow to remind people not to resurrect the old name, for example:

# spelling.yml is disabled per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p

Finally, you should consider sending a Pull Request to an open branch in which you have not performed the proper solution to verify that the old version of…