CVE-2024-21623
📋 TL;DR
CVE-2024-21623 is an expression injection vulnerability in OTClient's GitHub Actions workflow that allows remote code execution on GitHub runners. Attackers can execute arbitrary commands, leak secrets, and modify repositories through the vulnerable workflow. This affects OTClient users who run the 'Analysis - SonarCloud' GitHub Actions workflow prior to the fix.
💻 Affected Systems
- OTClient
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GitHub runner, allowing attackers to steal repository secrets, inject malicious code into the repository, pivot to other systems, and maintain persistent access.
Likely Case
Unauthorized code execution leading to secret exfiltration (tokens, credentials) and potential repository manipulation or data theft.
If Mitigated
Limited impact with proper GitHub Actions security controls, secret management, and runner isolation in place.
🎯 Exploit Status
Exploitation requires triggering the vulnerable GitHub Actions workflow, which can be done through pull requests or other workflow triggers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit db560de0b56476c87a2f967466407939196dd254
Vendor Advisory: https://github.com/mehah/otclient/security/advisories/GHSA-q6gr-wc79-v589
Restart Required: No
Instructions:
1. Update to commit db560de0b56476c87a2f967466407939196dd254 or later. 2. Replace the vulnerable workflow file with the patched version. 3. Review and update any other workflows that may have similar patterns.
🔧 Temporary Workarounds
Disable vulnerable workflow
allTemporarily disable the 'Analysis - SonarCloud' GitHub Actions workflow to prevent exploitation.
Navigate to repository Settings > Actions > Workflow permissions > Disable workflow
Implement workflow input validation
allAdd input validation and sanitization to GitHub Actions workflow files.
Review and modify workflow YAML files to validate all user inputs
🧯 If You Can't Patch
- Disable GitHub Actions entirely for the repository
- Implement strict branch protection rules and require manual approval for workflow runs
🔍 How to Verify
Check if Vulnerable:
Check if your .github/workflows/analysis-sonarcloud.yml file contains the vulnerable code pattern from lines 91-104 in the reference link.Check Version:
git log --oneline -1Verify Fix Applied:
Verify that your workflow file matches the patched version from commit db560de0b56476c87a2f967466407939196dd254.📡 Detection & Monitoring
Log Indicators:
- Unexpected workflow runs
- Suspicious commands in GitHub Actions logs
- Unauthorized repository modifications
Network Indicators:
- Unusual outbound connections from GitHub runners
- Unexpected API calls to external services
SIEM Query:
source="github-actions" AND (command="curl" OR command="wget" OR command="bash -c")🔗 References
- https://github.com/mehah/otclient/blob/72744edc3b9913b920e0fd12e929604f682fda75/.github/workflows/analysis-sonarcloud.yml#L91-L104
- https://github.com/mehah/otclient/commit/db560de0b56476c87a2f967466407939196dd254
- https://github.com/mehah/otclient/security/advisories/GHSA-q6gr-wc79-v589
- https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
- https://securitylab.github.com/research/github-actions-untrusted-input/
- https://github.com/mehah/otclient/blob/72744edc3b9913b920e0fd12e929604f682fda75/.github/workflows/analysis-sonarcloud.yml#L91-L104
- https://github.com/mehah/otclient/commit/db560de0b56476c87a2f967466407939196dd254
- https://github.com/mehah/otclient/security/advisories/GHSA-q6gr-wc79-v589
- https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
- https://securitylab.github.com/research/github-actions-untrusted-input/
