CVE-2024-42370
In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.
- CVSS 3.1
- 8.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
- EPSS
- 0.65% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Source
- security-advisories@github.com
References
- https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17
- https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml
- https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b
- https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.