Wondering how this kind of thing can be automatically discovered by an LLM. Anyone have any experience?
Ask an LLM and find out
Helm local code execution via a malicious chart
31–40 of 99 posts
Re: Helm local code execution via a malicious chart
#32So the attack vector is: - You have access to my file system - You have access to the helm repository You place malicious binaries outside the helm directory. Helm will now execute malicious code through the helm chart pointing outside the helm directory. Don't I have already bigger problems if you have access to my file system to place there malicious code? Is the danger here that one can get an execute permission?…
[deleted]
Re: Helm local code execution via a malicious chart
#33What is the attack scenario here? Where are the security boundaries? How does the attacker gets their repository with a symlink in it to the victim? Is Helm typically run as a privileged user? How would this work? And why doesn't the vulnerability description give answers to these questions?
[dead]
Re: Helm local code execution via a malicious chart
#34So the attack vector is: - You have access to my file system - You have access to the helm repository You place malicious binaries outside the helm directory. Helm will now execute malicious code through the helm chart pointing outside the helm directory. Don't I have already bigger problems if you have access to my file system to place there malicious code? Is the danger here that one can get an execute permission?…
Yeah, there is a rather strong "downloading and executing arbitrary code from the Internet may lead to execution of arbitrary code" kind of vibe there.
Re: Helm local code execution via a malicious chart
#35The original vulnerability description is not worded very well, here's my understanding of what's going on: 1. Attacker crafts a malicious Chart.yaml containing arbitrary code 2. Replaces Chart.lock with a symlink pointing to a sensitive file (like .bashrc or other startup scripts) 3. When you run helm dependency update, Helm processes the malicious Chart.yaml and writes the payload to whatever file the symlink targe…
thats funny because Helm refused to allow reference of external files (there is a github issue) but they follow symlinks xD
Re: Helm local code execution via a malicious chart
#36So the attack vector is: - You have access to my file system - You have access to the helm repository You place malicious binaries outside the helm directory. Helm will now execute malicious code through the helm chart pointing outside the helm directory. Don't I have already bigger problems if you have access to my file system to place there malicious code? Is the danger here that one can get an execute permission?…
> You place malicious binaries outside the helm directory
No, helm is the one doing this part in the vuln. Chart.lock is made a symlink to some important file, and helm will happily write to it.
Re: Helm local code execution via a malicious chart
#37But I thought security vulnerabilities couldn't happen in memory-safe languages!
This isn't a memory bug.
Re: Helm local code execution via a malicious chart
#38Earlier quoted context omitted.
You use invisible characters whenever you press Enter or Space. If you're referring to Tab, many of the most popular programming languages like Go and Python use them as part of their syntax. The reason YAML was popularized is because it was a response to XML which isn't user friendly to write. It's unfortunate that the spec got so convoluted, and uses a lot of implicit behavior, but I'd rather write YAML than XML, J…
i always enjoy writting json more. I feel it's easier to translate/integrate json into the code.
[dead]
Re: Helm local code execution via a malicious chart
#39As an aside, all these tools like aider, claude desktop ask for shell access to run codes.
Allowing LLMs to generate charts and what not via shell execution is a bad idea.
Re: Helm local code execution via a malicious chart
#40Earlier quoted context omitted.
You use invisible characters whenever you press Enter or Space. If you're referring to Tab, many of the most popular programming languages like Go and Python use them as part of their syntax. The reason YAML was popularized is because it was a response to XML which isn't user friendly to write. It's unfortunate that the spec got so convoluted, and uses a lot of implicit behavior, but I'd rather write YAML than XML, J…
It's unfortunate, but inevitable. Every structured text data format that sees widespread use, given enough time, will eventually be turned into a DSL.
In fact, once a structured text format is used as a data source for any process, it has already become a DSL.