CVE-2024-58354

{"id": "CVE-2024-58354", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58354", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T14:36:18.577336Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 6.0, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "calcom", "product": "cal.diy", "defaultStatus": "affected"}]}], "published": "2026-07-23T22:16:51.380", "references": [{"url": "https://github.com/calcom/cal.diy/commit/9aa60fae41a6b6b101c86bf430754b439f440871", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-p3f6-52gv-cj7m", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cal-com-repository-takeover-via-pull-request-target-workflow", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-p3f6-52gv-cj7m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then performs a 'dangerous' checkout of the attacker-submitted pull request code (via the dangerous-git-checkout action) and subsequently executes it (through yarn install and package.json scripts). An attacker can open a pull request whose code runs arbitrary commands with the repository's write-scoped GITHUB_TOKEN, allowing them to push commits, merge or mutate pull requests, add or delete comments, and delete or force-push branches, thereby compromising the repository. The main branch is affected; no patched version is available."}, {"lang": "es", "value": "cal.com (repositorio calcom, posteriormente renombrado cal.diy) est\u00e1 afectado por una vulnerabilidad de toma de control de repositorio en sus flujos de trabajo de GitHub Actions. El flujo de trabajo pr.yml utiliza el disparador pull_request_target con los permisos de escritura predeterminados del repositorio y los pasa a check-types.yml. check-types.yml luego realiza un checkout 'peligroso' del c\u00f3digo de la solicitud de extracci\u00f3n enviado por el atacante (a trav\u00e9s de la acci\u00f3n dangerous-git-checkout) y posteriormente lo ejecuta (mediante yarn install y scripts de package.json). Un atacante puede abrir una solicitud de extracci\u00f3n cuyo c\u00f3digo ejecuta comandos arbitrarios con el GITHUB_TOKEN con \u00e1mbito de escritura del repositorio, permiti\u00e9ndole enviar commits, fusionar o mutar solicitudes de extracci\u00f3n, a\u00f1adir o eliminar comentarios, y eliminar o forzar el env\u00edo de ramas, comprometiendo as\u00ed el repositorio. La rama principal est\u00e1 afectada; no hay una versi\u00f3n parcheada disponible."}], "lastModified": "2026-10-02T00:10:00.180", "sourceIdentifier": "disclosure@vulncheck.com"}