Helm up to 2.16.10/3.3.1 Plugin injection

Summaryinfo

A vulnerability described as critical has been identified in Helm up to 2.16.10/3.3.1. This vulnerability affects unknown code of the component Plugin Handler. Such manipulation leads to injection. This vulnerability is documented as CVE-2020-15187. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Helm up to 2.16.10/3.3.1. Affected by this issue is an unknown code block of the component Plugin Handler. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.

The weakness was released 09/17/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2020-15187 since 06/25/2020. The exploitation is known to be difficult. The attack needs to be approached locally. The requirement for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 2.16.11 or 3.3.2 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-161515, VDB-161514 and VDB-161513. Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Helm

Version

• 2.16.0
• 2.16.1
• 2.16.2
• 2.16.3
• 2.16.4
• 2.16.5
• 2.16.6
• 2.16.7
• 2.16.8
• 2.16.9
• 2.16.10
• 3.3.0
• 3.3.1

Website

• Product: https://github.com/helm/helm/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion