CVE-2024-4254: Gradio Information Disclosure Vulnerability

CVE-2024-4254 Overview

CVE-2024-4254 affects the deploy-website.yml GitHub Actions workflow in the gradio-app/gradio repository. The workflow explicitly checks out and executes code from forked pull requests. This design allows untrusted code to run in a privileged context with access to repository secrets and push permissions to the base repository [CWE-214].

A successful attack exfiltrates high-value secrets including GITHUB_TOKEN, HF_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID, COMMENT_TOKEN, AWSACCESSKEYID, AWSSECRETKEY, and VERCEL_TOKEN. Attackers can pivot from these credentials to AWS, Vercel, and Hugging Face resources.

Critical Impact
An attacker submitting a crafted pull request from a fork can steal repository secrets and gain push access to the base repository, enabling supply chain compromise.

Affected Products

gradio-app/gradio repository - main branch
Workflow file: .github/workflows/deploy-website.yml at commit 72f4ca88ab569aae47941b3fb0609e57f2e13a27
Downstream consumers of the Gradio Python package published through this pipeline

Discovery Timeline

2024-06-04 - CVE-2024-4254 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4254

Vulnerability Analysis

The deploy-website.yml workflow triggers on pull_request_target or an equivalent privileged event. This event context runs in the base repository with access to secrets, unlike the safer pull_request event. The workflow then performs an explicit checkout of the fork's head reference and executes its build scripts.

Any attacker who opens a pull request from a fork controls the code executed inside the runner. That code runs with the base repository's secrets injected as environment variables. The attacker exfiltrates the secrets through outbound HTTP requests, DNS queries, or by writing them to build artifacts.

The leaked GITHUB_TOKEN grants write access to the repository during the workflow run. Combined with the leaked cloud credentials, an attacker can tamper with releases, deploy malicious code, or access AWS and Vercel infrastructure connected to the project.

Root Cause

The root cause is improper authorization in the CI/CD workflow design. The workflow trusts fork-submitted code by executing it directly while retaining privileged secret access. GitHub's own documentation warns against combining pull_request_target with explicit fork checkout for this exact reason.

Attack Vector

Exploitation requires the attacker to open a pull request from a fork containing modified build or test scripts. When a maintainer or automated trigger runs the workflow, the malicious code executes with secret access. The attacker then transmits captured secrets to an external endpoint.

No authentication to the target repository is required beyond a standard GitHub account. User interaction from a maintainer may be needed depending on the workflow trigger configuration.

For technical details, see the Huntr Bug Bounty Report.

Detection Methods for CVE-2024-4254

Indicators of Compromise

Unexpected outbound network connections from GitHub Actions runners to attacker-controlled domains during pull request workflow runs
Unauthorized use of GITHUB_TOKEN, HF_TOKEN, VERCEL_TOKEN, or AWS access keys from IP addresses outside GitHub Actions ranges
Unexpected commits, releases, or tag operations performed by GitHub Actions immediately after a fork pull request event
Modifications to build scripts, package.json, or workflow-invoked files within incoming pull requests from external forks

Detection Strategies

Audit workflow run logs for pull_request_target events that executed code from fork checkouts
Correlate secret usage events in AWS CloudTrail, Vercel, and Hugging Face audit logs with GitHub Actions run timestamps
Implement GitHub audit log monitoring for anomalous workflows.completed_workflow_run events tied to external contributors

Monitoring Recommendations

Enable GitHub Advanced Security secret scanning with push protection on the repository
Forward GitHub Actions and cloud provider audit logs to a centralized SIEM for cross-source correlation
Alert on workflow runs where the head repository differs from the base repository and secrets are referenced

How to Mitigate CVE-2024-4254

Immediate Actions Required

Rotate all secrets referenced by the workflow: GITHUB_TOKEN, HF_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID, COMMENT_TOKEN, AWSACCESSKEYID, AWSSECRETKEY, and VERCEL_TOKEN
Remove explicit fork checkouts from any workflow using pull_request_target
Review AWS, Vercel, and Hugging Face audit logs for unauthorized activity dating to before secret rotation
Restrict which contributors can trigger workflows on pull requests through repository settings

Patch Information

No formal patched version is listed in NVD. Remediation requires modifying the deploy-website.yml workflow to eliminate untrusted fork code execution in a privileged context. Consult the Huntr Bug Bounty Report for the disclosed remediation guidance.

Workarounds

Split the workflow into an untrusted build stage using pull_request and a separate privileged deploy stage triggered only on merges to main
Use GitHub Environments with required reviewers to gate secret access on pull request workflows
Replace long-lived cloud credentials with short-lived OpenID Connect (OIDC) federated tokens scoped to specific branches
Apply the principle of least privilege by scoping GITHUB_TOKEN permissions to read-only at the workflow level

bash

# Example workflow hardening for .github/workflows/deploy-website.yml
name: deploy-website
on:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          persist-credentials: false