8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-42370

CVE-2024-42370: Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow

Withdrawn Advisory

This advisory has been withdrawn because the confidentiality, integrity, and availability impacts of the vulnerability affect Litestar's CI/CD environment rather than the litestar package. While the information in the advisory is still valid, users of the litestar package are not affected and do not need to receive Dependabot alerts.

Original Advisory

Summary

Litestar's docs-preview.yml workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.

Environment Variable injection (`GHSL-2024-177`)

The docs-preview.yml workflow gets triggered when the Tests And Linting workflow completes:

on:
  workflow_run:
    workflows: [Tests And Linting]
    types: [completed]

Later, it downloads and extracts an artifact generated by the triggering workflow:

- name: Download artifact
uses: dawidd6/action-download-artifact@v6
with:
  workflow_conclusion: success
  run_id: ${{ github.event.workflow_run.id }}
  path: docs-preview
  name: docs-preview

And reads docs-preview/.pr_number into an Environment Variable:

- name: Set PR number
  run: echo "PR_NUMBER=$(cat docs-preview/.pr_number)" >> $GITHUB_ENV

The $GITHUB_ENV pointed file is just a regular file where every KEY=VALUE will be used to define a new Environment Variable after the step completes. Since the contents of the .pr_number file have not been validated, they may contain new lines that will cause new Environment Variables to be defined.

An attacker can send a malicious .pr_number file with the following content:

111
LD_PRELOAD=/home/runner/work/litestar/litestar/inject.so

Miggo Vulnerability Database

→

CVE-2024-42370

CVE-2024-42370:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
litestar	pip	<= 2.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The primary vulnerability stems from the workflow step that reads untrusted artifact content (.pr_number) and appends it directly to GITHUB_ENV without validation. This allows injection of arbitrary environment variables through newline characters. The secondary vulnerable pattern was in ci.yml's PR number handling before patching. The high confidence comes from the direct manipulation shown in the PoC and the subsequent validation added in the fix commit. The medium confidence for ci.yml comes from the original pattern that could enable workflow context manipulation, though the main attack vector was through docs-preview.yml.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2024-42370: Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow

Withdrawn Advisory

Original Advisory

Summary

Environment Variable injection (GHSL-2024-177)

CVE-2024-42370:

8.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

8.3

8.3

Technical Details

CVE-2024-42370: Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow

Withdrawn Advisory

Original Advisory

Summary

Environment Variable injection (GHSL-2024-177)

PoC

Impact

Remediation

Resources

Disclosure Policy

Environment Variable injection (`GHSL-2024-177`)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Environment Variable injection (`GHSL-2024-177`)