Listen to this Post
The command injection vulnerability in Wrangler’s `pages deploy` command arises from the unsafe handling of the `–commit-hash` CLI parameter. When a user executes wrangler pages deploy, the value provided to `–commit-hash` is stored in a variable named commitHash. This user-controlled input is then directly interpolated into a shell command string using JavaScript template literals. The vulnerable code path calls `execSync(`git show -s –format=%B ${commitHash}), which spawns a shell process. Since no validation, sanitization, or escaping is performed on the `commitHash` variable, any shell metacharacters it contains are interpreted by the shell. An attacker can inject characters such as semicolons (;), backticks (`), or dollar signs followed by parentheses ($()) to terminate the intended git command and execute arbitrary subsequent commands. This exploitation is possible because the `execSync` function passes the string to a system shell (e.g., /bin/sh) for execution. The vulnerability is particularly dangerous in automated CI/CD pipelines where the `–commit-hash` argument is often populated from external, untrusted sources like git commit messages or webhook data. In such environments, an attacker could modify a commit hash to include malicious payloads. When the Wrangler command runs in the pipeline, the injected commands execute with the privileges of the CI runner process. This allows for complete compromise of the build environment, enabling activities like stealing secrets from environment variables, installing persistent backdoors, or tampering with deployment artifacts. The root cause is the failure to neutralize special elements used in an OS command, classified as CWE-78.
Platform: Cloudflare Wrangler
Version: v4 <4.59.1, v3 <3.114.17
Vulnerability : Command Injection
Severity: Critical
date: 2024-06-01
Prediction: Patched 2024-06-01
What Undercode Say:
Analytics
Example of vulnerable command execution
wrangler pages deploy --commit-hash "123456; malicious_command"
Underlying Node.js code snippet
const commitHash = args['--commit-hash'];
const output = execSync(<code>git show -s --format=%B ${commitHash}</code>);
How Exploit
Attacker controls `–commit-hash` parameter, injecting shell metacharacters to execute arbitrary commands on the CI/CD runner or local system.
Protection from this CVE
Upgrade to Wrangler v4.59.1+ or v3.114.17+. Sanitize all user inputs used in shell commands.
Impact
Arbitrary command execution. Environment variable exfiltration. CI runner compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
