fkie_cve-2024-42370

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.

Withdrawn: GHSA-4hq2-rpgc-r8r7 — Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow

Withdrawn by the publisher.

Affected: PyPI: litestar

## Withdrawn Advisory This advisory has been withdrawn because the confidentiality, integrity, and availability impacts of the vulnerability affect Litestar's CI/CD environment rather than the `litestar` package. While the information in the advisory is still valid, users of the `litestar` package are not affected and do not need to receive Dependabot alerts.

## Original Advisory

### Summary Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.

### Environment Variable injection (`GHSL-2024-177`)

The [`docs-preview.yml` workflow](https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml) gets triggered when the `Tests And Linting` workflow completes:

```yaml on: workflow_run: workflows: [Tests And Linting] types: [completed] ```

Later, it downloads and extracts an artifact generated by the triggering workflow:

```yaml - name: Download artifact uses: dawidd6/action-download-artifact@v6 with: workflow_conclusion: success run_id: ${{ github.event.workflow_run.id }} path: docs-preview name: docs-preview ```

And reads `docs-preview/.pr_number` into an Environment Variable:

```yaml - name: Set PR number run: echo "PR_NUMBER=$(cat docs-preview/.pr_number)" >> $GITHUB_ENV ```

The `$GITHUB_ENV` pointed file is just a regular file where every `KEY=VALUE` will be used to define a new Environment…

Most recent entries from all

fkie_cve-2024-42370

Withdrawn: GHSA-4hq2-rpgc-r8r7 — Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow