Command Injection in Renovate Gradle Wrapper

Executive Summary

This vulnerability is a command injection flaw in Renovate versions 32.124.0 to 42.68.4 and Mend renovate-ce/renovate-ee before 13.3.0. When Renovate updates Gradle Wrapper, it runs a shell command to handle the wrapper update. If an attacker adds a malicious gradle-wrapper.properties file with shell command substitution syntax like $(...) in the distributionUrl, the shell executes it before Gradle processes the URL, allowing arbitrary command execution in Renovate's runtime.

Useful 0 Not Useful 0

Detection Guidance

Check Renovate logs for Gradle Wrapper update commands. Inspect repositories for gradle-wrapper.properties files with malicious distributionUrl values containing shell syntax like $(...). Use commands like grep -r 'distributionUrl.*$(' /path/to/repos to search for suspicious files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could execute arbitrary commands within Renovate's runtime environment. This may lead to exposure of credentials, modification of repositories, or access to internal resources. The attack requires the attacker to place a malicious file in a scanned repository but works even if allowScripts is disabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution in Renovate's runtime environment, potentially exposing sensitive data such as credentials or internal resources. For GDPR, this may result in unauthorized access to personal data, violating principles of data protection and security. For HIPAA, it could allow unauthorized access to protected health information, compromising confidentiality and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Renovate to version 42.68.5 or later (42.74.5 for specific managers). Disable Gradle Wrapper updates if not needed. Review and remove any suspicious gradle-wrapper.properties files in scanned repositories.

Useful 0 Not Useful 0