PT-2024-29904 · Litestar · Litestar

Pwntester · Published 2024-08-09 · Updated 2024-08-15 · CVE-2024-42370

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Litestar versions 2.10.0 and prior

Description The issue is related to Environment Variable injection in Litestar's docs-preview.yml workflow, which may lead to secret exfiltration and repository manipulation. This grants a malicious actor permission to write issues, read metadata, and write pull requests. The DOCS PREVIEW DEPLOY TOKEN is also exposed to the attacker. The vulnerability allows an attacker to send a malicious .pr number file, which can define new Environment Variables, including LD PRELOAD, to force the system to load a malicious shared library. This can result in arbitrary code execution when the node command is run.

Recommendations For Litestar versions 2.10.0 and prior, verify the contents of the downloaded artifacts and do not allow new lines in the value redirected to GITHUB ENV. As a temporary workaround, consider restricting access to the docs-preview.yml workflow until a fix is applied. Update to a version that includes the fix, as commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.

Exploit

Fix

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-74

CWE-78

Related Identifiers

CVE-2024-42370

GHSA-4HQ2-RPGC-R8R7

Affected Products

Litestar

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42370.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42370 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42370 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hq2-rpgc-r8r7 · Vendor Advisory
• https://github.com/litestar-org/litestar · Note
• https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml · Note
• https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7 · Note
• https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17 · Note
• https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b · Note
• https://twitter.com/cracbot/status/1824325324257234945 · Twitter Post
• https://twitter.com/GHSecurityLab/status/1823830724723568783 · Twitter Post
• https://twitter.com/CveFindCom/status/1822937176390221886 · Twitter Post
• https://twitter.com/cracbot/status/1823962927445254385 · Twitter Post
• https://twitter.com/cracbot/status/1823600533497897163 · Twitter Post