CVE-2024-52587

Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time.

Details

1. setup.ts:169 1 performs execSync with a command that gets
   invoked after interpretation by the shell. This command includes an
   interpolated process.env.USER variable, which an attacker could
   modify (without actually creating a new user) to inject arbitrary
   shell expressions into this execSync. This may or may not be likely
   in practice, but I believe the hygienic way to perform the underlying
   operation is to use execFileSync or similar and bypass the
   underlying shell evaluation.

2. setup.ts:229 2 has a nearly identical execSync to (1) above,
   but with $USER for shell-level interpolation rather than string
   interpolation. However, this is still injectable and would be best
   replaced by an execFileSync, per above.

3. arc-runner:40-44 3 has an execSync with multiple string
   interpolations. Most of these do not appear immediately injectible
   (since they appear to come from presumed trusted API responses), but
   the expansion of getRunnerTempDir() may be injectable due to its
   dependence on potentially attacker-controllable environment variables
   (e.g. RUNNER_TEMP). The underlying operation appears to be a trivial
   file copy, so this entire subprocess should in theory be replaceable
   with ordinary NodeJS fs API calls instead.

4. arc-runner:53 4 demonstrates the same weakness, and has the same
   resolution as (3).

5. arc-runner:57 demonstrates the same weakness as (3) and (4), and
   has the same resolution.

6. arc-runner:61 demonstrates the same weakness as (3), (4), and (5),
   and has the same resolution.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

CVE-2024-52587 has a CVSS score of 8.8 (Low). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.10.2); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2024-52587? CVE-2024-52587 is a low-severity OS command injection vulnerability in step-security/harden-runner (actions), affecting versions < 2.10.2. It is fixed in 2.10.2. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. How severe is CVE-2024-52587? CVE-2024-52587 has a CVSS score of 8.8 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of step-security/harden-runner are affected by CVE-2024-52587? step-security/harden-runner (actions) versions < 2.10.2 is affected.
4. Is there a fix for CVE-2024-52587? Yes. CVE-2024-52587 is fixed in 2.10.2. Upgrade to this version or later.
5. Is CVE-2024-52587 exploitable, and should I be worried? Whether CVE-2024-52587 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-52587 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-52587? Upgrade step-security/harden-runner to 2.10.2 or later.