Harden-Runner Umgehung der 'disable-sudo'-Richtlinie

The disable-sudo feature in Harden-Runner is intended to prevent the GitHub Actions runner user from executing commands with elevated privileges. However, due to a design flaw, members of the Docker group can leverage the Docker daemon to circumvent this restriction. An attacker could exploit this vulnerability to launch privileged containers, access the host filesystem, and ultimately gain root access to the underlying system. This could lead to unauthorized code execution, data theft, and complete compromise of the CI/CD pipeline. The impact is particularly severe as it affects the security of automated build and deployment processes.

Organizations heavily reliant on GitHub Actions for CI/CD pipelines are at significant risk. Specifically, deployments utilizing older versions of Harden-Runner (0.12.0 - 2.11.9) and granting the runner user broad Docker group permissions are particularly vulnerable. Shared hosting environments where multiple users share a runner instance also face increased exposure.

• docker: Inspect Docker group membership for the runner user.

getent group docker | grep -q 'runner' && echo 'Potential Vulnerability: Runner user is in Docker group'

• docker: Monitor Docker daemon logs for unusual container creation or privilege escalation attempts. • generic web: Review GitHub Actions workflows for any suspicious commands or container configurations. • linux / server: Audit Docker daemon configuration for overly permissive settings. • windows / supply-chain: (Less relevant, but check for Docker Desktop installations on runner machines and their configurations.)

1. 2025-04-21Disclosure

   disclosure

1. Reserviert2025-04-14
2. Veröffentlicht2025-04-21
3. Geändert2025-04-22
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-32955 is to upgrade Harden-Runner to version 2.12.0 or later, which addresses the sudo bypass vulnerability. If an immediate upgrade is not feasible, consider restricting access to the Docker daemon or removing the runner user from the Docker group. While not a complete solution, this can reduce the attack surface. Review and audit Docker configurations to ensure least privilege principles are enforced. After upgrading, verify the disable-sudo policy is functioning as expected by attempting to execute sudo commands as the runner user and confirming they are denied.