Nuclio dashboard: namespace headers reach /bin/sh unquoted on the list-all path, unauthenticated RCE

Impact

The earlier hardening of the dashboard's shell command construction added name validation and quoting only for the named-resource path. When no specific resource name is given, the list-all path still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c string, and that parameter is taken from the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace or X-Nuclio-Function-Event-Namespace request headers. An unauthenticated caller therefore still gets arbitrary command execution inside the dashboard container, which is the container that holds the Docker socket on the local/Docker platform. Anyone who patched for the earlier issue and considered the matter closed is still exposed until 1.17.4.

Who can reach it

Anyone who can reach the Nuclio dashboard HTTP API on a local/Docker-platform deployment. No authentication needed; the payload goes in an HTTP header.

What to do

Upgrade to Nuclio 1.17.4 and restart the dashboard container. There is no configuration switch for this path, so until the upgrade the only mitigation is network isolation of the dashboard plus an authenticating proxy that strips the X-Nuclio-*-Namespace headers.

References

Related entries

• runc: Host runc binary overwritten from inside a containerCVE-2019-5736 · runcHigh
• Envoy: ext-authz header handling flaw allows bypassing the external authorization serviceCVE-2021-32777 · EnvoyHigh
• Envoy: URI fragment treated as part of the pathCVE-2021-32779 · EnvoyHigh
• Envoy: Processing continues after a local reply, causing undefined behaviourCVE-2021-32781 · EnvoyHigh
• Envoy: Malicious client constructs permanently valid credentials in the OAuth filterCVE-2023-35941 · EnvoyHigh
• podman build and buildah: race with --jobs during a malicious Containerfile build breaks out to the hostCVE-2024-11218 · podman build / buildah (concurrent --jobs Containerfile build race)High