ScanCode.io command injection in docker image fetch process
Date: 2023-08
Affected: pip/scancodeio
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-39523
CWE: CWE-77
CVSS: 6.8 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)

## Command Injection in docker fetch process ### Summary A possible command injection in the docker fetch process as it allows to append malicious commands in the docker_reference parameter. ### Details In the function `scanpipe/pipes/fetch.py:fetch_docker_image`[1] the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`. ```python def fetch_docker_image(docker_reference, to=None): """ code snipped .... """ platform_args = [] platform = get_docker_image_platform(docker_reference) # User controlled `docker_reference` passed """ code snipped... """ ``` However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. ```python def get_docker_image_platform(docker_reference): """ Return a platform mapping of a docker reference. If there are more than one, return the first one by default. """ skopeo_executable = _get_skopeo_location() """ Constructing a shell command with user controlled variable `docker_reference` """ cmd = ( f"{skopeo_executable} inspect --insecure-policy --raw --no-creds " f"{docker_reference}" ) logger.info(f"Fetching image os/arch data: {cmd}") exitcode, output = pipes.run_co


Mitigations:

Architectural layers (MAESTRO):