Security vulnerabilities have been detected in popular package managers, allowing threat actors to execute arbitrary code on the target system and access sensitive data. Package managers are tools that enable easy installation, updating, and configuration of third-party dependencies required by applications.
The detected security vulnerabilities are in the following package managers;
• Composer
• Bundler
• Bower
• Poetry
• Yarn
• pnpm
• Pip
• Pipenv
The vulnerability found in Composer and tracked with code CVE-2021-41116 is a Command Injection vulnerability that could allow remote threat actors to execute arbitrary commands on the target system. Argument Injection and Untrusted Search Path security vulnerabilities found in Bundler, Poetry, Yarn, Pip, and Pipenv can allow threat actors to execute arbitrary code on the target system via malware-laden Git or Gemfiles files.
The package managers fixed the vulnerabilities that were foreseen to be used in supply chain attacks shortly after the announcement. However, the Untrusted Search Path vulnerability affecting three package managers, Composer, Pip, and Pipenv, is still not fixed. In this context, it is recommended that users using vulnerable package manager versions immediately upgrade to the published updates in order not to be the target of attacks that can be carried out using vulnerabilities.
Who found these flaws, and when?
The flaws come from research by Paul Gerste at Sonar, published on 8 March 2022 in Sonar’s blog post on securing package managers. According to that post, Sonar reported the argument injection and untrusted search path issues to eight projects on 9 September 2021. The attacks need a victim to load a malicious package or file, so they are not remote attacks that work with no user action.
How do the attacks work?
Sonar describes three kinds of bugs.
- Command injection in Composer. On Windows, the
composer browsecommand wrapped a URL in quotes twice, so escaping failed. A package with a crafted source URL could then run an attacker’s program. The NVD entry for CVE-2021-41116 says Windows users who install untrusted dependencies are affected, and other operating systems and WSL are not. It also says there is no workaround, and that Composer 1.10.23 and 2.1.9 fix it. - Argument injection in Bundler and Poetry. A Git-based dependency value that starts with a dash is read as a Git option. A Gemfile entry can pass
--upload-packand make Git run a script of the attacker’s choice. - Untrusted search path. On Windows, a command that is called by name looks in the current folder first. A fake
git.exeplaced in a project folder can run instead of the real Git while dependencies install.
Which versions are fixed?
Sonar lists these fixed releases: Bundler 2.2.33, Bower 1.8.13, Poetry 1.1.9, Yarn 1.22.13, pnpm 6.15.1, and Composer 1.10.23 or 2.1.9 for the command injection. The Composer maintainers declined to fix the search path issue, saying it is outside their threat model. Pip and Pipenv also declined, because other routes to code execution exist in the same situation. That matches the warning above that three tools remain open to this issue.
What should teams do?
Update the package managers on developer machines and build servers to the fixed versions. On Windows, do not install packages from unknown sources, and avoid running install commands from folders you do not trust. Review Git dependencies in lock files and Gemfiles before you build. Brandefense vulnerability intelligence helps teams watch for issues like these.