Summary
A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of the Kubernetes Headlamp project. This issue arises due to the improper use of Node.js's execSync() function with unsanitized input derived from environment variables, which can be influenced by an attacker.
The vulnerable script 5bc0a9d accepts values from:
teamIDentitlementsPathconfig.app
The variables ${teamID}, ${entitlementsPath}, and ${config.app} are dynamically derived from the environment or application config and passed directly to the shell command without proper escaping or argument separation. This exposes the system to command injection if any of the values contain malicious input.
Impact
An attacker who can control any of the affected environment variables can execute arbitrary shell commands on the macOS build system during the packaging process. This is particularly impactful in CI/CD environments where workflows might automatically set environment variables or build unsigned packages without strict checks.
References
opsysdebug Analyst
Summary
A command injection vulnerability was discovered in the
codeSign.jsscript used in the macOS packaging workflow of the Kubernetes Headlamp project. This issue arises due to the improper use of Node.js'sexecSync()function with unsanitized input derived from environment variables, which can be influenced by an attacker.The vulnerable script 5bc0a9d accepts values from:
teamIDentitlementsPathconfig.appThe variables
${teamID},${entitlementsPath}, and${config.app}are dynamically derived from the environment or application config and passed directly to the shell command without proper escaping or argument separation. This exposes the system to command injection if any of the values contain malicious input.Impact
An attacker who can control any of the affected environment variables can execute arbitrary shell commands on the macOS build system during the packaging process. This is particularly impactful in CI/CD environments where workflows might automatically set environment variables or build unsigned packages without strict checks.
References
headlamp@codeSign