PT-2024-31779 · Arduino · Arduino-Esp32

Pwntester · Published 2024-09-17 · Updated 2024-09-20 · CVE-2024-45798

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: arduino-esp32 (affected versions not specified)

Description: The issue concerns multiple Poisoned Pipeline Execution (PPE) vulnerabilities in the arduino-esp32 CI, including code injection in the tests results.yml workflow and environment variable injection. These vulnerabilities have the potential for repository takeover and enable remote attacks with high impact. Users are advised to verify the contents of the downloaded artifacts.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

OS Command Injection

RCE

Weakness Enumeration

CWE-94

CWE-78

CWE-20

Related Identifiers

CVE-2024-45798

GHSA-H52Q-XHG2-6JW8

Affected Products

Arduino-Esp32

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45798.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-45798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45798 · Security Note
• https://github.com/espressif/arduino-esp32/security/advisories/GHSA-h52q-xhg2-6jw8 · Note
• https://github.com/espressif/arduino-esp32/blob/690bdb511d9f001e2066da2dda2c631a3eee270f/.github/workflows/tests_results.yml · Note
• https://securitylab.github.com/research/github-actions-preventing-pwn-requests · Note
• https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection · Note
• https://twitter.com/GHSecurityLab/status/1837163676572258764 · Twitter Post
• https://twitter.com/CveFindCom/status/1836110623748300987 · Twitter Post
• https://t.me/cvedetector/5840 · Telegram Post
• https://twitter.com/Vu1nAlert/status/1836121381307646264 · Twitter Post
• https://securitylab.github.com/research/github-actions-untrusted-input · Note
• https://twitter.com/oktsec/status/1836142536240349305 · Twitter Post