CVE-2023-31128

Deeper analysis

NextCloud Cookbook, a recipe management application for NextCloud, contains a command-injection vulnerability in its GitHub Actions workflow file pull-checks.yml. The workflow directly interpolates the attacker-controlled github.head_ref value into a shell command without sanitization, enabling CWE-78 injection when a pull request is processed. The flaw existed prior to commits a46d9855 (master) and 489bb744 (main-0.9.x) and affected only the repository’s CI infrastructure, not deployed instances of the app.

An attacker who can open a pull request against a vulnerable fork or the upstream repository can supply a head_ref containing shell metacharacters (for example, zzz";echo${IFS}"hello";#). Because the workflow’s permissions were not restricted, successful injection grants the ability to execute arbitrary commands in the runner context, potentially leading to repository write access, secret exfiltration, or further lateral movement within the GitHub Actions environment.

The project’s security advisory GHSA-c5pc-mf2f-xq8h and the linked commits document the remediation, which replaces the untrusted input with a safe reference. The accompanying GitHub Security Lab reference on untrusted workflow inputs provides the general hardening guidance applied in the fix. The associated EPSS score reached a peak of 0.1532, indicating measurable post-disclosure exploitation interest.