CVE-2024-41127

🎯 CVE-2024-41127 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2024-41127 | Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact

Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact to the steps.pr_num_reader.outputs.content WorkFlow variable. It is not validated that the variable is actually a number and later it is interpolated into a JS script allowing an attacker to change the code to be executed. This issue leads to pull-requests write access. This vulnerability is fixed in 24.30.0.

Klassifikation & Betroffenheit:

CWE-74 monkeytypegame monkeytype < 24.30.0monkeytype monkeytype *

Improper Neutralization of Special Elements in Output Used by a Downstream Component 🎯 High

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

🛡️ Empfohlene Mitigation: Programming languages and supporting technologies might be chosen which are not subject to these issues.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-10 · Buffer Overflow via Environment Variable… (High) CAPEC-13 · Subverting Environment Variable Values (Very High) CAPEC-14 · Client-side Injection-induced Buffer Ove… (High) CAPEC-101 · Server Side Include (SSI) Injection (High) CAPEC-105 · HTTP Request Splitting (High) CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-120 · Double Encoding (Medium) CAPEC-135 · Format String Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1562.003 · Impair Defenses:Impair Command His… T1574.006 · Hijack Execution Flow:Dynamic Link… T1574.007 · Hijack Execution Flow:Path Interce…

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-20231 9.9 CVE-2026-54680 9.9 CVE-2025-55343 9.9 CVE-2023-39424 9.9 CVE-2023-29516 9.9

🧪 Exploit-Evidenz:

🐙 pvharmo2/gha-lab-83342297e0

🩹 Patch verfügbar (OSV):

🩹 7e399b6b9f8b9c18d5f232cdc66d1416847fea56 (Commit) 🩹 29627fd0d5f152e2da59671987090ea0a5c29874 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2024

Veröffentlicht 08/2024

Heute 09.11.

CVSS-Vektor-Analyse: 8.4

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Keine

UI · Interaktion Erforderlich

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CNA-Bewertung (GitHub_M): 8.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Veröffentlicht:02.08.2024

Aktualisiert:17.06.2026 07:47

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2024-38940

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-74 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.559	0,9 %
≥10 %	13.139	3,2 %
<10 %	396.072	95,8 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.559

0,9 %

≥10 %

13.139

3,2 %

<10 %

396.072

95,8 %

8.4 HIGH

EPSS

0.9%

CVE-2024-41127 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

monkeytypegame

CVE-2024-41127 | Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact

CWE-74 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 2 Jahren ↻ vor 2 Jahren

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub