pvharmo2/gha-lab-6904b2ccbeSecurity-research lab: reproduction of CVE-2025-61584 (GHSA-9g7x-737f-5xpc) — command injection via github.head_ref in pull_request_target workflow (.github/workflows/pr.yml)
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
serverless-dns/serverless-dnsat commitb0b1a1538aeb1991b5bc13dfe4e18e686913b12e(2025-04-26), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2025-04-26; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
serverless-dns is a Pi-Hole esque content-blocking, serverless, stub DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) resolver. Runs out-of-the-box on Cloudflare Workers, Deno Deploy, Fastly Compute@Edge, and Fly.io. Free tiers of all these services should be enough to cover 10 to 20 devices worth of DNS traffic per month.
RethinkDNS runs serverless-dns in production at these endpoints:
| Cloud platform | Server locations | Protocol | Domain | Usage |
|---|---|---|---|---|
| ⛅ Cloudflare Workers | 280+ (ping) | DoH | sky.rethinkdns.com | configure |
| 🦕 Deno Deploy | 30+ (ping) | DoH | private beta | |
| ⏱️ Fastly Compute@Edge | 80+ (ping) | DoH | private beta | |
| 🪂 Fly.io | 30+ (ping) | DoH and DoT | max.rethinkdns.com | configure |
Server-side processing takes from 0 milliseconds (ms) to 2ms (median), and end-to-end latency (varies across regions and networks) is between 10ms to 30ms (median).
The Rethink DNS resolver on Fly.io is sponsored by FOSS United.
Cloudflare Workers is the easiest platform to setup serverless-dns:
For step-by-step instructions, refer:
| Platform | Difficulty | Runtime | Doc |
|---|---|---|---|
| ⛅ Cloudflare | Easy | v8 Isolates | Hosting on Cloudflare Workers |
| 🦕 Deno.com | Moderate | Deno Isolates | Hosting on Deno.com |
| ⏱️ Fastly Compute@Edge | Easy | Fastly JS | Hosting on Fastly Compute@Edge |
| 🪂 Fly.io | Hard | Node MicroVM | Hosting on Fly.io |
To setup blocklists, visit https://<my-domain>.tld/configure from your browser (it should load something similar to RethinkDNS' configure page).
For help or assistance, feel free to open an issue or submit a patch.
Code:
# navigate to work dir
cd /my/work/dir
# clone this repository
git clone https://github.com/serverless-dns/serverless-dns.git
# navigate to serverless-dns
cd ./serverless-dns
Node:
# install node v22+ via nvm, if required
# https://github.com/nvm-sh/nvm#installing-and-updating
wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash
nvm install --lts
# download dependencies
npm i
# (optional) update dependencies
npm update
# run serverless-dns on node
./run n
# run a clinicjs.org profiler
./run n [cpu|fn|mem]
Deno:
# install deno.land v2+
# https://github.com/denoland/deno/#install
curl -fsSL https://deno.land/install.sh | sh
# run serverless-dns on deno
./run d
Fastly:
# install node v22+ via nvm, if required
# install the Fastly CLI
# https://developer.fastly.com/learning/tools/cli
# run serverless-dns on Fastly Compute@Edge
./run f
Wrangler:
# install Cloudflare Workers (cli) aka Wrangler
# https://developers.cloudflare.com/workers/cli-wrangler/install-update
npm i wrangler --save-dev
# run serverless-dns on Cloudflare Workers (cli)
# Make sure to setup Wrangler first:
# https://developers.cloudflare.com/workers/cli-wrangler/authentication
./run w
# profile wrangler with Chrome DevTools
# blog.cloudflare.com/profiling-your-workers-with-wrangler
Commits on this repository enforces the Google JavaScript style guide (ref: .eslintrc.cjs).
A git pre-commit hook that runs linter (eslint) and formatter (prettier) on .js files. Use git commit --no-verify
to bypass this hook.
Pull requests are also checked for code style violations and fixed automatically where possible.
Configure env.js if you need to tweak the defaults.
For Cloudflare Workers, setup env vars in wrangler.toml, instead.
For Fastly Compute@Edge, setup env vars in fastly.toml, instead.
src/server-[node|workers|deno] <-> doh.js <-> plugin.jsplugin.js flow: user-op.js -> cache-resolver.js -> cc.js -> resolver.js