Workflow allows command execution through the standard output stream

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_186
Category	Input Validation
Severity	MEDIUM

Impact

The ACTIONS_ALLOW_UNSECURE_COMMANDS environment variable is set to 'True' in the GitHub Actions workflow. This setting, which was deprecated by GitHub, allows the workflow to evaluate the set-env and add-path commands once they have been written to the standard output stream. This can lead to command execution in the workflow. For example, a workflow that prints the title of new GitHub issues to the standard output stream, would allow an attacker to create a GitHub issue with a malicious title that would be evaluated by the workflow. Note: although this setting was deprecated by GitHub, it is still functional. For more information see: https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w

Recommended Solution - Buildtime

Disable the use of unsecure commands in GitHub Actions workflows in one of the following two manners:

• Set the ACTIONS_ALLOW_UNSECURE_COMMANDS environment variable to False.

• Delete the environment variable.

  📌 NOTE By default, deleting the environment variable sets the environment variable to False.