Listen to this Post
The vulnerability exists in the Hermit package manager integration within Renovate. When processing dependency updates, user-controlled input from the `depName` variable is directly concatenated into shell commands for `./hermit install` and `./hermit uninstall` without proper sanitization. The `packagesToInstall` and `packagesToUninstall` arrays in `lib/modules/manager/hermit/artifacts.ts` fail to use the `shlex.quote()` function. This allows an attacker with commit rights to a repository to craft a malicious dependency name containing shell metacharacters (e.g., || kill 1 ||). When Renovate scans the repo and processes the specially crafted `renovate.json5` configuration, it executes the hermite manager, which then interprets the unescaped `depName` as part of the shell command. This leads to the injection and execution of arbitrary commands in the context of the Renovate process, granting control over the host system.
Platform: Renovate
Version: >=32.135.0
Vulnerability: Command Injection
Severity: Critical
date: 2022-07-30
Prediction: 2024-12-01
What Undercode Say:
curl -fsSL "${HERMIT_DIST_URL}/install.sh" -o "${INSTALL_SCRIPT}"
exec "${HERMIT_EXE}" --level=fatal exec "$0" -- "$@"
{$schema: "https://docs.renovatebot.com/renovate-schema.json",customDatasources: {always: {defaultRegistryUrlTemplate: "https://docs.renovatebot.com/search/search_index.json",transformTemplates: ['{"releases":[{"version":"99999.0.0"}]}'],},},
bin/.|| kill 1 ||@0.0.1.pkg
How Exploit:
Craft malicious `depName`.
Configure `renovate.json5` `overrideDatasource`.
Renovate scans, triggers command execution.
Protection from this CVE
Apply `shlex.quote()`.
Input validation.
Update Renovate.
Impact:
Arbitrary command execution.
Host compromise.
CI/CD pipeline breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
