GHSA-wg5p-8h9p-3mr7 agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code ExecutionSummary`agent-coderag` unconditionally executes a repository-controlled `gradlew` script during its default `sync` dependency-discovery flow. An attacker who can induce a victim to index a malicious Gradle repository (one containing `build.gradle` and a crafted `gradlew`) achieves arbitrary code execution with the victim's OS privileges. No authentication, no extra flags, and no elevated permissions are required; the attack fires on the default `agent-coderag sync <path>` invocation.DetailsThe vulnerability exists across a four-step call chain in the `sync` command:**1. Entry point — `code_rag/entry/cli.py:70`**`sync_dependencies()` is called unconditionally before indexing. There is no opt-in flag; any `agent-coderag sync` invocation triggers dependency discovery.**2. Gradle project detection — `code_rag/core/manager.py:40-47`**The presence of a `build.gradle` or `build.gradle.kts` file in the target directory is sufficient to invoke `_sync_gradle()`. No additional checks are performed.**3. Wrapper selection — `code_rag/core/manager.py:110-113`**When a repository-local `gradlew` exists, it is unconditionally preferred over the system-installed `gradle`. No content validation, signature check, or integrity verification is performed on this file.**4. Execution sink — `code_rag/core/manager.py:152-158`**The attacker-controlled `gradlew` is executed directly via `asyncio.create_subprocess_exec()` with the repository root as the working directory. `validate_path` (`code_rag/core/utils.py:7-71`) only constrains the path location (directory boundary), not the content or nature of the executed binary.The complete data flow: `cli.py:277` (path input) → `cli.py:313-314` (`sync_cmd`) → `cli.py:62` (`validate_path`) → `cli.py:70` (`sync_dependencies`) → `manager.py:40-47` (`_sync_gradle`) → `manager.py:110-113` (wrapper selection) → `manager.py:152-158` (execution sink).PoC**Environment setup:****Build the malicious repository:****Trigger the vulnerability (victim action):****Verify exploitation:****Docker-based reproduction (as confirmed in Phase 2):**Phase 2 dynamic reproduction confirmed the following output:ImpactThis is an **Arbitrary Code Execution (ACE)** vulnerability triggered by a local attack vector. Any user who runs `agent-coderag sync` against an attacker-controlled directory is affected. The attack requires no authentication and no special privileges beyond the ability to supply a path argument.Typical impacted scenarios include:A developer cloning an untrusted repository and running `agent-coderag sync` to index it for AI-assisted code analysis.A CI/CD pipeline that automatically indexes pull-request branches containing a crafted `gradlew`.Any tooling or script that passes arbitrary paths to `agent-coderag sync` without user oversight.Because the vulnerable component (`agent-coderag`) is a code-indexing tool intended to *read* repositories, victims have no expectation that indexing will *execute* files within the repository. This trust-boundary violation (reflected in the CVSS `S:C` — Changed Scope) means the impact extends beyond the tool itself to the victim's entire user session environment: confidentiality (credential theft, secret exfiltration), integrity (file modification, persistence installation), and availability (process termination, disk exhaustion) are all fully compromised.Reproduction artifacts`Dockerfile``poc.py`
CVSS v3.1 score: 8.6