CVE-2024-58376: Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 37.199.0 - Compensating control
Restrict commit access to Renovate configurations/repositories so attackers cannot manipulate registryAliases keys that are processed during helm repo add operations.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs commit access to a repository processed by Renovate and must be able to manipulate helmv3 registryAliases keys. The injected commands run during helm repo add operations.
What access could an attacker gain?
Successful exploitation allows arbitrary command execution with full access to Renovate's execution environment. This can affect confidentiality, integrity, and availability of resources accessible from that environment.
Which Renovate versions are affected?
Renovate versions from 37.158.0 up to, but not including, 37.199.0 are affected. Upgrade to 37.199.0 or later.