Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Acme.sh runs arbitrary commands from a remote server

github.com

Post reply on HN
Print view View original

1–10 of 71 posts

Re: Acme.sh runs arbitrary commands from a remote server

#4

Post by tinus_hn »

com wrote: post #3
AmenBreak wrote: post #2

Is this part of Plan 9?

Unfortunately this is related to acme.sh, a shell script tool to request new and replace free certificates. So far, this GitHub issue is quite disturbing.

IMO it’s just a demonstration why you don’t write complicated or security sensitive code in shell script: it’s basically impossible to get right, there’s pitfalls around every corner and it’s extremely difficult to check for mistakes.

Re: Acme.sh runs arbitrary commands from a remote server

#6

Post by stavros »

regecks wrote: post #5

I think the title buries the most horrifying part of this. The HiCA certificate authority is relying on an RCE to do an end-run around the semantics of the ACME HTTP-01 validation method. Fucked up and they should be booted from every root program for this.

Wow, that's... bold.

Re: Acme.sh runs arbitrary commands from a remote server

#7

Post by 0x0 »

Looks like they are issuing under a sub-CA of "ssl.com" according to https://github.com/acmesh-official/acme.sh/issues/4659#issue...

Interestingly, the mozilla dev-security-policy group seems to contain a recent discussion about including "ssl.com" in the root store here https://groups.google.com/a/mozilla.org/g/dev-security-polic...

Curious to know if this could, maybe it should, have ripple effects to the various SSL Root CA programs. Having someone run a subCA that actually exploits an RCE against ACME clients doesn't seem very trustworthy, and any CA enabling this behaviour should probably be kicked out of the trust stores?

Re: Acme.sh runs arbitrary commands from a remote server

#8

Post by pazderski »

tinus_hn wrote: post #4
com wrote: post #3

Earlier quoted context omitted.

Unfortunately this is related to acme.sh, a shell script tool to request new and replace free certificates. So far, this GitHub issue is quite disturbing.

IMO it’s just a demonstration why you don’t write complicated or security sensitive code in shell script: it’s basically impossible to get right, there’s pitfalls around every corner and it’s extremely difficult to check for mistakes.

I wouldn't say there are too many pitfalls. Quote all variables (acme.sh seem to do well on that part) and don't use eval (probably the reason for this problem).

Re: Acme.sh runs arbitrary commands from a remote server

#9

Post by agwa »

regecks wrote: post #5

I think the title buries the most horrifying part of this. The HiCA certificate authority is relying on an RCE to do an end-run around the semantics of the ACME HTTP-01 validation method. Fucked up and they should be booted from every root program for this.

They aren't in any root programs. They're just taking certificate requests and relaying them to real CAs, which is why they need to exploit an RCE in the ACME client, since the ACME client wouldn't otherwise be able to complete the validations required by the actual CA.

Re: Acme.sh runs arbitrary commands from a remote server

#10

Post by agwa »

0x0 wrote: post #7

Looks like they are issuing under a sub-CA of "ssl.com" according to https://github.com/acmesh-official/acme.sh/issues/4659#issue... Interestingly, the mozilla dev-security-policy group seems to contain a recent discussion about including "ssl.com" in the root store here https://groups.google.com/a/mozilla.org/g/dev-security-polic... Curious to know if this could, maybe it should, have ripple effects to the various S…

The sub CA is operated by ssl.com, not HiCA (which is not a trusted certificate authority). HiCA is relaying the certificate requests to ssl.com, which is properly validating the requests in accordance with all the requirements. ssl.com isn't doing anything wrong. That's why HiCA needs to exploit an RCE in acme.sh - ACME doesn't support relaying certificate requests to other CAs like this.
Post reply on HN