Meshtastic GitHub Actions Workflow Fork Checkout Vulnerability Allowing Arbitrary Code Execution

A critical vulnerability has been identified in the Meshtastic GitHub repository's main_matrix.yml workflow, prior to version 2.7.21.1370b23. This vulnerability arises from the workflow being triggered by pull_request_target, which allows external contributors to execute code from their forks with access to repository secrets and elevated GITHUB_TOKEN permissions. The absence of an approval gate means that pull requests from external users can automatically trigger this workflow. The vulnerability could lead to a supply chain compromise, a takeover of the repository, and a compromise of self-hosted GitHub runners.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the context of the GitHub Actions workflow, with access to repository secrets and elevated GITHUB_TOKEN permissions. This could result in a supply chain compromise, a takeover of the repository, and a compromise of self-hosted GitHub runners.

Reproduction

To reproduce this vulnerability, fork the Meshtastic firmware repository and replace a build script with a malicious payload. Then, open a pull request from the forked repository. The main_matrix.yml workflow will automatically trigger, checking out the fork and executing the malicious code with access to repository secrets.

Remediation

Users can update to Meshtastic version 2.7.21.1370b23 or later, where this vulnerability has been patched.