Impact

The test-bug-run-badge.yml workflow evaluates attacker-controlled issue body content as JavaScript.
Any GitHub user can exfiltrate the workflow's GITHUB_TOKEN by opening a bug report issue, gaining the ability to manipulate all issues and pull requests in the repository, including the ability to add tags, like the release tags.

What an attacker achieves:

• Exfiltrate GITHUB_TOKEN (scoped issues: write) via issue comment — renewable on every new issue
• With issues: write, the attacker can:
  • Add or remove labels on any issue or pull request
  • Close, reopen, or lock any issue
  • Edit issue titles, bodies, assignees, and milestones
  • Post comments impersonating automated tooling
• Attacker can add the release tag - if a maintainer miss the addition, a merge may end up as a release.
  • Pushes a new image to DockerHUb
  • Pushes a new image to GHCR

Taking a look at our recent release history there doesn't seem to be any sign of an unauthorized release.
This should not effect most users.
If you forked the shields repository and using our workflow in your own repository, please consider applying the fix to your own repository as well.

Patches

We decided to remove this workflow.
The workflow is removed at d925b81
This workflow was added at af7b7f3
All repo commits from af7b7f3 to 1f10232 are vulnerable.

If someone still wants to use this workflow, the reporter added a suggested patch which we confirmed to work

      - name: Add Comment to Issue
        uses: actions/github-script@v9
+       env:
+         BADGE_LINK: ${{ needs.extract-bug-badge-url.outputs.link }}
        with:
          script: |
+           const badgeLink = process.env.BADGE_LINK;
            const issueNumber = context.issue.number;
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const runId = context.runId;
            const jobUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}`;
            const issueComment = `
-             Badge tested using \`npm run badge ${{ needs.extract-bug-badge-url.outputs.link }}\`
+             Badge tested using \`npm run badge ${badgeLink}\`
              Output is available [here](${jobUrl})
            `;
            github.rest.issues.createComment({

Credit

Identified using VeeVee Agent, validated and disclosed by @EladMeged-Novee on behalf of Novee Security.