Earlier quoted context omitted.
This isn't a memory bug.
And Helm isn't written in Rust, so their snark was doubly misplaced
Fwiw, Go is also considered memory-safe although not as strict as Rust
Helm local code execution via a malicious chart
71–80 of 99 posts
Re: Helm local code execution via a malicious chart
#72Earlier quoted context omitted.
If being able to create files and symlinks to them is a pre-condition for this, then it's not a serious security bug. If you have that kind of access then there are a million nefarious things you can do. This is almost becoming a joke at this point, "assuming an attacker has access to the system, they can change things on the system".
I create a malicious chart or compromise one you use (with symlink to an arbitrary file and code). You download charts either as a tarball from a helm repo or oci registry with helm and helm will create the files and links with your permissions, and send me whatever I wanted to extract from your system. Yes, you should check things you download from the internet. But also, that is not how a chart is supposed to work.
As noted in other comments, a symlink is just a text reference to a file. It does not need to be created on the host system.
Re: Helm local code execution via a malicious chart
#73Helm is an abomination, as the whole idea of using a text template engine to generate YAML is. And this vulnerability adds insult to injury ;) Sorry, just can't really recover from trauma of counting spaces and messing up newlines, etc. when writing Helm templates. You know, Lisp "sucks" because "you need to count parenthesis" (you actually don't), yet Helm is a widely accepted technology where you need to count spac…
This isn't a uniquely helm thing though, they mostly use modified go templating. Lots of other things do this with yaml as well.
Re: Helm local code execution via a malicious chart
#74Helm is an abomination, as the whole idea of using a text template engine to generate YAML is. And this vulnerability adds insult to injury ;) Sorry, just can't really recover from trauma of counting spaces and messing up newlines, etc. when writing Helm templates. You know, Lisp "sucks" because "you need to count parenthesis" (you actually don't), yet Helm is a widely accepted technology where you need to count spac…
I don’t think there is a lot of overlap between people who say lisp sucks because of the parens and people who are fine with using a template to generate yaml.
Re: Helm local code execution via a malicious chart
#75So the attack vector is: - You have access to my file system - You have access to the helm repository You place malicious binaries outside the helm directory. Helm will now execute malicious code through the helm chart pointing outside the helm directory. Don't I have already bigger problems if you have access to my file system to place there malicious code? Is the danger here that one can get an execute permission?…
> But if you can manipulate my helm chart why can you not also place the malicious code in the helm directory?
If you can manipulate my helm chart, why not just do the RCE directly in my kubernetes cluster or whatever?
Re: Helm local code execution via a malicious chart
#76Earlier quoted context omitted.
Sarcasm aside: wearing a helmet causes riders to take more risks, leading to more accidents. https://www.sciencedirect.com/science/article/pii/S136984781... I’d still wear one, but also try to be more careful knowing that the helmet provides a false sense of security. I do believe the analogy holds very true with programming habits.
Did you read the abstract? It says the exact opposite: > this systematic review found little to no support for the hypothesis bicycle helmet use is associated with engaging in risky behaviour.
What! You’re lying!
Re: Helm local code execution via a malicious chart
#77Earlier quoted context omitted.
YAML is a superset of JSON, so go right ahead and write your .yml files in JSON.
YAML is actually not a superset of JSON. https://john-millikin.com/json-is-not-a-yaml-subset https://news.ycombinator.com/item?id=30052633
The NO case is not valid JSON.
So that leaves scientific notation.
Re: Helm local code execution via a malicious chart
#78But I thought security vulnerabilities couldn't happen in memory-safe languages!
I would argue that not sanitising strings is analogous to a form of memory unsafety. You take as an input, an opaque blob of bytes that you then pass on to a myriad of other libraries and pieces of code. Nothing is captured in the types other than "String". Mainstream programming languages need to make it easier to define new types and parse strings into them. Rust is very promising in this area, as it features algebraic data types.
Re: Helm local code execution via a malicious chart
#79Earlier quoted context omitted.
YAML is actually not a superset of JSON. https://john-millikin.com/json-is-not-a-yaml-subset https://news.ycombinator.com/item?id=30052633
The NO case is not valid JSON. So that leaves scientific notation.
The point is that "going right ahead and write your .yml files in JSON" is not valid. You'd have to restrict yourself to a subset of JSON to not get different semantics.
Re: Helm local code execution via a malicious chart
#80Helm is an abomination, as the whole idea of using a text template engine to generate YAML is. And this vulnerability adds insult to injury ;) Sorry, just can't really recover from trauma of counting spaces and messing up newlines, etc. when writing Helm templates. You know, Lisp "sucks" because "you need to count parenthesis" (you actually don't), yet Helm is a widely accepted technology where you need to count spac…
I'm a dev that jumped to devops and one of my pet peeves will always be the lengths devops engineers go to avoid using a real programming language. Instead of interacting with all these APIs through python, ruby, lua, go, whatever they would rather build hodgepodge systems in bash, coreutils, curl (or wget. or both!) and jq (which is the worst). Or in the case of helm, just creating a half yaml/half Go SDK for generating YAML.
Even the helm infrastructure that I work in is completely wrapped in custom shell scripts that call all sorts of other commands to populate helm variables.
But yeah it's silly that helm templates require all sorts of {{ indent | 4 }} type incantations when the final YAML output is just sent through some kind of toJSON anyway.