Listen to this Post
How the CVE-2024-53019 Command Injection Works:
The vulnerability exists within Renovate’s Gleam language package manager module. When processing dependencies from a `gleam.toml` file, the manager constructs a shell command to update packages. The user-controlled dependency names from the `gleam.toml` file are inserted into the `packagesToUpdate` variable in lib/modules/manager/gleam/artifacts.ts. These values are concatenated directly into the `gleam deps update` command string without being sanitized or escaped using the `shlex.quote` function. An attacker with commit access can create a malicious `gleam.toml` file containing a dependency name with shell metacharacters (e.g., "|| kill 1"). By combining this with a specially crafted `renovate.json5` configuration that forces Renovate to process the malicious dependency, the attacker can inject arbitrary commands. When Renovate scans the repository, it executes the tainted command, leading to the injection and execution of the attacker’s payload on the host system running Renovate.
dailycve form:
Platform: Renovate
Version: >=39.53.0
Vulnerability: Command Injection
Severity: Critical
date: 2024-12-06
Prediction: 2024-12-20
What Undercode Say:
Analytics:
Example malicious gleam.toml dependency entry
[bash]
"|| kill 1" = "0.1.0"
Renovate configuration to trigger the manager
{
"matchManagers": ["gleam"],
"overrideDatasource": "custom.always"
}
How Exploit:
Malicious `gleam.toml` + crafted `renovate.json5`.
Protection from this CVE:
Apply security patch.
Input sanitization/escaping.
Restrict repository access.
Impact:
Arbitrary command execution.
Host compromise.
Container termination.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
