Secrets Exfiltration Vulnerability in Gradio Deploy-Website Workflow

CVE-2024-4254

What is CVE-2024-4254?

A vulnerability exists in the 'deploy-website.yml' workflow within the Gradio App repository that exposes significant risks through improper authorization practices. This vulnerability allows for the potential exfiltration of sensitive secrets, including GITHUB_TOKEN, HF_TOKEN, and AWSACCESSKEYID, because the workflow performs an explicit checkout and execution of code from a forked repository. This risky behavior enables the execution of untrusted code in an environment with permissions to push changes to the base repository and access sensitive data. Such flaws can severely compromise the integrity of the environment and the confidentiality of sensitive tokens used in deployment. Security measures must be implemented to prevent unauthorized access and mitigate the risk of data leaks.

References