Attack Chain

1. An attacker crafts a malicious pull request containing arbitrary commands within package.json scripts.
2. The attacker submits this pull request to the vulnerable cal.com repository.
3. The pr.yml GitHub Actions workflow is triggered by the pull_request_target event.
4. The pr.yml workflow, by design, passes its default repository write permissions (via GITHUB_TOKEN) to the check-types.yml workflow.
5. The check-types.yml workflow uses a "dangerous" checkout action to fetch the attacker's malicious pull request code.
6. check-types.yml executes yarn install and subsequent package.json scripts from the attacker-controlled code.
7. The attacker's arbitrary commands are executed with the repository's write-scoped GITHUB_TOKEN.
8. The attacker gains full control over the repository, capable of pushing commits, merging pull requests, and manipulating branches, leading to a complete repository compromise.

Impact

The successful exploitation of CVE-2024-58354 results in a complete repository takeover for the affected cal.com GitHub repository. Attackers can gain the ability to inject malicious code, tamper with the software supply chain, delete or alter source code, and potentially compromise the integrity of releases. This could lead to backdoored software distributed to users, data exfiltration from the repository, or disruption of development workflows. As the main branch is affected and no patch is available, the risk remains high for organizations using or contributing to the cal.com project.

Recommendation

• Review all GitHub Actions workflows, particularly pr.yml and check-types.yml, for the use of pull_request_target in conjunction with write permissions and dangerous checkout actions as described in CVE-2024-58354.
• Disable or refactor GitHub Actions workflows that use pull_request_target with default write permissions and perform untrusted code execution to mitigate CVE-2024-58354.
• Implement "least privilege" for GitHub Actions workflows, explicitly limiting permissions for GITHUB_TOKEN rather than relying on default write permissions.
• Audit existing GitHub Actions workflow logs for any suspicious activity or unexpected command execution that could indicate prior exploitation of CVE-2024-58354.