Listen to this Post
Renovate, when processing Gradle Wrapper updates, executes shell commands to handle artifacts. Specifically, it runs commands like `./gradlew :wrapper –gradle-distribution-url /bin/sh -c. The `distributionUrl` is sourced from the `gradle/wrapper/gradle-wrapper.properties` file in the repository. If an attacker injects shell command substitution syntax—e.g., $(command)—into the distributionUrl, the shell evaluates this embedded command before the URL is validated by Gradle. This occurs because the entire command string is passed to the shell, which interprets metacharacters. Consequently, arbitrary commands execute within the Renovate runtime environment. After command execution, Gradle attempts to parse the resulting URL as a URI, often failing with a URISyntaxException, but the malicious code has already run. This vulnerability persists even with `allowScripts` disabled (default OFF), as it stems from Gradle Wrapper artifact handling, not repository install scripts. Exploitation requires an attacker to insert a malicious `gradle-wrapper.properties` into a repository scanned by Renovate, such as via direct write access or a merged PR. Upon successful injection, commands run with the permissions of the Renovate bot, potentially leading to data exfiltration, credential theft, or further system compromise. Proof of concept demonstrates this by setting `distributionUrl` to $(cat /etc/passwd > /tmp/passwd_dump), which creates a file during Renovate’s update step.
Platform: Renovate
Version: <42.68.5
Vulnerability: Command Injection
Severity: Critical
date: 2025-12-31
Prediction: Patched 2025-12-31
What Undercode Say:
Analytics
- Renovate execution command: `/bin/sh -c “./gradlew :wrapper –gradle-distribution-url $(id > /tmp/exploit)”`
– Malicious `gradle-wrapper.properties` entry: `distributionUrl=https://example.com/$(cat /etc/passwd > /tmp/passwd_dump)`
– Gradle validation error: `java.net.URISyntaxException`
How Exploit
- Modify `gradle-wrapper.properties` with malicious URL.
- Commit changes to repository.
- Trigger Renovate scan.
- Shell command executes during update.
Protection from this CVE
- Upgrade to Renovate 42.68.5+.
- For composer/yarn v1/flux, use 42.74.5+.
Impact
- Arbitrary command execution.
- Credential and token exposure.
- Repository modification or internal access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
