GHSA-79qw-g77v-2vfh: Inspektor Gadget: Command Injection via malicious buildOptions manipulation
Impacted Resources`inspektor-gadget/cmd/common/image/build.go`
`inspektor-gadget/cmd/common/image/helpers/Makefile.build`DescriptionThe `ig` binary provides a subcommand for image building, used to generate custom gadget OCI images.A part of this functionality is implemented in the file `inspektor-gadget/cmd/common/image/build.go`.The following is the code responsible to construct the build command:The `Makefile.build` file is the Makefile template employed during the building process.This file includes user-controlled data in an unsafe fashion, specifically some parameters are embedded without an adequate escaping in the commands inside the Makefile.This implementation is vulnerable to command injection: an attacker able to control values in the `buildOptions` structure would be able to execute arbitrary commands during the building process.ImpactAn attacker able to exploit this vulnerability would be able to execute arbitray command:on the Linux host where the `ig` command is launched, if images are built with the `--local` flagon the build container invoked by `ig`, if the `--local` flag is not providedAttack ComplexityThe `buildOptions` structure is extracted from the YAML [gadget manifest](https://inspektor-gadget.io/docs/latest/gadget-devel/building#customizing-your-build) passed to the `ig image build` command. Therefore, the attacker would need a way to control either the full `build.yml` file passed to the `ig image build` command, or one of its options.Typically, this could happen in a CI/CD scenario that builds untrusted gadgets to verify correctness.PoCPoC 1  (Vector: cflags)Create the file `build.yaml` with the following content:Create the file `gadget.yaml` with the following content:Create the file `program.bpf.c` with the following content:In the same directory where the files are run the command:Notice that the file `poc1.txt` gets created inside the directory.PoC2 (Vector: ebpfsource, wasm)Create the file `build.yaml` with the following content:Create the file `$(shell touch poc2-1.txt)`:In the same directory where the files are run the command:Notice that the files `poc2-1.txt` and `poc2-2.txt` get created inside the directory.PoC3 (Vector: -o, --output)Create the file `build.yaml` with the following content:Create the file `gadget.yaml` with the following content:Create the directory `$(shell touch poc3.txt)`:Retrieve the full path of the created directory:In the same directory where the files are run the command replacing the `<PATH>` placeholder with the value retrieved at step 4:Notice that the file `poc3.txt` gets created inside the directory.PoC4 (Vector: --btfhub-archive)Create the file `build.yaml` with the following content:Create the file `test.c`:In the same directory where the files are run the commandNotice that the file `poc4.txt` gets created inside the directory.Suggested RemediationSanitize build options by providing a robust whitelist to filter on.
Alternatively, revisit the design of image building to prevent shell substitution.Referenceshttps://cwe.mitre.org/data/definitions/77.htmlhttps://cwe.mitre.org/data/definitions/78.html
CVSS v4.0: 6.6