Listen to this Post
This vulnerability stems from pnpm’s handling of dependencies fetched via HTTP/HTTPS tarball URLs and Git-hosted tarballs. When resolving such dependencies, the tarball resolver returns only the remote URL without generating or storing a cryptographic integrity hash (like SHA-512) in the project’s lockfile (pnpm-lock.yaml). Consequently, the lockfile entry for the dependency contains only the tarball URL under the `resolution` field, with no accompanying `integrity` checksum. During installation, pnpm fetches the tarball from the stored URL but has no baseline hash to verify the downloaded content against. This allows a remote server to serve entirely different tarball contents on subsequent installation requests, even when a lockfile is present and committed to version control. The absence of integrity validation bypasses a core security guarantee of lockfiles, which is to ensure deterministic installations. Attackers controlling the dependency server or able to compromise the hosting endpoint can exploit this to deliver targeted, malicious code selectively to specific users or CI/CD environments based on request characteristics.
Platform: pnpm
Version: <9.6.0
Vulnerability: Missing Integrity Hash
Severity: Critical
date: 2024-09-03
Prediction: Patch Released
What Undercode Say:
cat pnpm-lock.yaml | grep -A2 "tarball: http"
// resolving/tarball-resolver/src/index.ts
return { resolution: { tarball: resolvedUrl } };
How Exploit:
- Attacker publishes a package with an HTTP tarball dependency.
- The package is installed by victims, creating a lockfile without an integrity hash.
- The attacker’s server inspects incoming requests (e.g., via User-Agent, IP).
- The server responds with malicious code tailored to the specific requester.
- The victim’s next `pnpm install` fetches the malicious payload, bypassing lockfile protection.
Protection from this CVE
Update pnpm to version 9.6.0 or later. Avoid dependencies on HTTP/HTTPS tarball URLs and Git-hosted tarballs. Use packages exclusively from the npm registry which enforces integrity hashing. Audit lockfiles for entries lacking an `integrity` field.
Impact:
Supply Chain Compromise, Targeted Attacks, Audit Evasion
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
