Harden-Runner GitHub Action Outbound Network Logging Bypass Vulnerability

A vulnerability in the Harden-Runner GitHub Action (Community Tier) prior to version 2.14.2 allows outbound network connections to evade audit logging. This issue affects traffic using the sendto, sendmsg, and sendmmsg socket system calls, which can bypass detection when the egress policy is set to audit. The vulnerability requires code execution capabilities within the GitHub Actions workflow, such as through workflow injection or compromised dependencies.

Impact

Exploitation of this vulnerability allows for outbound network traffic to be sent without generating audit logs, effectively bypassing network monitoring for UDP communications.

Remediation

Users of the Harden-Runner Community Tier should upgrade to version 2.14.2 or later. Enterprise Tier users are not affected by this vulnerability.