A flaw in the GitHub Actions workflow for PyPI ’s source repository could be exploited to potentially execute arbitrary code on pypi.org.
Security researcher RyotaK disclosed three flaws in PyPI, the most severe one could potentially lead to the compromise of the entire PyPI infrastructure.
Python Package Index (PyPI) is the official third-party software repository for Python. PyPI as an index allows users to search for packages by keywords or by filters against their metadata, such as free software license or compatibility with POSIX.
The flaw affects the combine-prs.yml workflow in pypa/warehouse, which includes the current source code of PyPI.
This workflow allows to collect pull requests that have branch names starting with dependabot and merge them into a single pull request.
The workflow fails to verify the pull request author, this means that anyone could create a pull request with a specific name and have the workflow to process it.
The workflow did not verify the pull request author, anyone could create a pull request with a specific name and have the workflow to process it. RyotaK pointed out that it is still not possible to execute code because the workflow only combines pull requests and the result is reviewed by a human operator that could detect and discard any malicious code.
RyotaK discovered a flaw in the code used for printing branch lists of pull requests, the issue could be exploited to execute commands and leak GitHub Access Token with write permission against the pypa/warehouse repository.
“In this line, combine-prs.yml prints branch lists of pull requests by using the following code. It’s a simple echo command, which looks fine at first glance, but it’s not safe due to the GitHub Actions’ behavior.” states the expler
run: |
echo “${{steps.fetch-branch-names.outputs.result}}”
“Because this workflow used actions/checkout, .git/config contains secrets.GITHUB_TOKEN, which has the write permissions. So, by executing commands like cat .git/config, it’s possible to leak GitHub Access Token with write permission against the pypa/warehouse repository. As described above, if someone pushed changes to the main branch, it’ll trigger the automatic deployment to pypi.org.”
Once an attacker has obtained write permission to the repository, it will be able to execute arbitrary code on pypi.org.
Below the step by step procedure to execute arbitrary codes on pypi.org:
Fork pypa/warehouseIn forked repository, create a branch named dependabot;cat$IFS$(echo$IFS’LmdpdA==’|base64$IFS’-d’)/config|base64;sleep$IFS’10000′;#4Add harmless modification to the created branchCreate a pull request with a harmless name (e.g.: WIP)Wait for combine-prs.yml to be executedA GitHub Access Token that has the write permissions against pypa/warehouse will be leaked, so add an arbitrary modification to the main branchModified codes will be deployed to pypi.orgThe expert reported this vulnerability to Python’s security team that fixed it.
In an update provided on 31 July, the researcher @mrtc0 explained that the attack procedure above doesn’t work. RyotaK agreed and provided the following procedure:
attack procedure.
Fork pypa/warehouseFind a branch that starts with dependabot in pypa/warehouseIn forked repository, add a harmless modification to the branch that you found in step 2Create a pull request named `;github.auth().then(auth=>console.log(auth.token.split(“”)))//Wait for combine-prs.yml to be executedA GitHub Access Token that has the write permissions against pypa/warehouse will be leaked, so add an arbitrary modification to the main branchModified codes will be deployed to pypi.orgThe vulnerability discovered by the expert could have a significant impact to the Python ecosystem, the expert highlighted the risks of supply chain attacks.
Follow me on Twitter: @securityaffairs and Facebook
try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini
(SecurityAffairs – hacking, PyPI )
The post Experts found potential remote code execution in PyPI appeared first on Security Affairs.