Description
StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.
Published: 2024-11-18
Score: 2.7 Low
EPSS: 2.0% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-3251 StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.
Github GHSA Github GHSA GHSA-g85v-wf27-67xc Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`
History

Fri, 22 Nov 2024 14:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 19 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Step Security
Step Security harden Runner
CPEs cpe:2.3:a:step_security:harden_runner:*:*:*:*:*:*:*:*
Vendors & Products Step Security
Step Security harden Runner
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 18 Nov 2024 22:15:00 +0000

Type Values Removed Values Added
Description StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.
Title Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 2.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U'}

Subscriptions

Step Security Harden Runner
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-11-19T14:38:08.418Z

Reserved: 2024-11-14T15:05:46.766Z

Link: CVE-2024-52587

cve-icon Vulnrichment

Updated: 2024-11-19T14:37:46.084Z

cve-icon NVD

Status : Deferred

Published: 2024-11-18T22:15:09.557

Modified: 2026-04-15T00:35:42.020

Link: CVE-2024-52587

cve-icon Redhat

Severity : Low

Publid Date: 2024-11-18T22:03:15Z

Links: CVE-2024-52587 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses