Update pnpm to v10 [SECURITY] (!39) · Merge requests · Gerrit Schröer / Medusa

FW Serviceworker requested to merge renovate/npm-pnpm-vulnerability into main Dec 15, 2024

This MR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	`9.1.3` -> `10.0.0`

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

CVE-2024-53866 / GHSA-vm32-9rqf-rh3r

More information

Details

Summary

pnpm seems to mishandle overrides and global cache:

Overrides from one workspace leak into npm metadata saved in global cache
npm metadata from global cache affects other workspaces
installs by default don't revalidate the data (including on first lockfile generation)

This can make workspace A (even running with ignore-scripts=true) posion global cache and execute scripts in workspace B

Users generally expect ignore-scripts to be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it).

Here, that expectation is broken

Details

See PoC.

In it, overrides from a single run of A get leaked into e.g. ~/Library/Caches/pnpm/metadata/registry.npmjs.org/rimraf.json and persistently affect all other projects using the cache

PoC

Postinstall code used in PoC is benign and can be inspected in https://www.npmjs.com/package/ponyhooves?activeTab=code, it's just a console.log

Remove store and cache On mac: rm -rf ~/Library/Caches/pnpm ~/Library/pnpm/store This step is not required in general, but we'll be using a popular package for PoC that's likely cached

Create A/package.json:

{
  "name": "A",
  "pnpm": { "overrides": { "rimraf>glob": "npm:ponyhooves@1" } },
  "dependencies": { "rimraf": "6.0.1" }
}

Install it with pnpm i --ignore-scripts (the flag is not required, but the point of the demo is to show that it doesn't help)

Create B/package.json:

{
  "name": "B",
  "dependencies": { "rimraf": "6.0.1" }
}

Install it with pnpm i

Result:

Packages: +3
+++
Progress: resolved 3, reused 3, downloaded 0, added 3, done
node_modules/.pnpm/ponyhooves@1.0.1/node_modules/ponyhooves: Running postinstall script, done in 51ms

dependencies:
+ rimraf 6.0.1

Done in 1.4s

Also, that code got leaked into another project and it's lockfile now!

Impact

Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs

As a work-around, use separate cache and store dirs in each workspace

Severity

CVSS Score: Unknown
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/MR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

CVE-2024-47829 / GHSA-8cc4-rfj6-fhg4

More information

Details

The path shortening function is used in pnpm：

export function depPathToFilename (depPath: string, maxLengthWithoutHash: number): string {
  let filename = depPathToFilenameUnescaped(depPath).replace(/[\\/:*?"<>|]/g, '+')
  if (filename.includes('(')) {
    filename = filename
      .replace(/\)$/, '')
      .replace(/(\)\()|\(|\)/g, '_')
  }
  if (filename.length > maxLengthWithoutHash || filename !== filename.toLowerCase() && !filename.startsWith('file+')) {
    return `${filename.substring(0, maxLengthWithoutHash - 27)}_${createBase32Hash(filename)}`
  }
  return filename
}

However, it uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. In the diagram, we assume that two packages are called packageA and packageB, and that the first 90 digits of their package names must be the same, and that the hash value of the package names with versions must be the same. Then C is the package that they both reference, but with a different version number. (npm allows package names up to 214 bytes, so constructing such a collision package name is obvious.)

Then hash(packageA@1.2.3)=hash(packageB@3.4.5). This results in the same path for the installation, and thus under the same directory. Although the package names under node_modoules are the full paths again, they are shared with C. What is the exact version number of C? In our local tests, it depends on which one is installed later. If packageB is installed later, the C version number will change to 2.0.0. At this time, although package A requires the C@1.0.0 version, package. json will only work during installation, and will not affect the actual operation. We did not receive any installation error issues from pnpm during our local testing, nor did we use force, which is clearly a case that can be triggered.

For a package with a package name + version number longer than 120, another package can be constructed to introduce an indirect reference to a lower version, such as one with some known vulnerability. Alternatively, it is possible to construct two packages with more than 120 package names + version numbers. This is clearly an advantage for those intent on carrying out supply chain attacks.

The solution: The repair cost is also very low, just need to upgrade the md5 function to sha256.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/MR:N/UI:N/S:C/C:L/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

pnpm/pnpm (pnpm)

Update pnpm to v10 [SECURITY]

pnpm no-script global cache poisoning via overrides / ignore-scripts evasion

Details

Summary

Details

PoC

Impact

Severity

References

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Details

Severity

References

Release Notes

Major Changes

Minor Changes

v9.15.9: pnpm 9.15.9

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.8: pnpm 9.15.8

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.7: pnpm 9.15.7

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.6: pnpm 9.15.6

Patch Changes

v9.15.5: pnpm 9.15.5

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.4: pnpm 9.15.4

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.3: pnpm 9.15.3

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.2: pnpm 9.15.2

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.1: pnpm 9.15.1

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.15.0: pnpm 9.15

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.14.4: pnpm 9.14.4

Patch Changes

Platinum Sponsors

Gold Sponsors

Silver Sponsors

v9.14.3: pnpm 9.14.3

Patch Changes

Platinum Sponsors

Gold Sponsors

Silver Sponsors

Patch Changes

Platinum Sponsors

Gold Sponsors

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v9.13.2: pnpm 9.13.2

Patch Changes

Platinum Sponsors

Gold Sponsors

Silver Sponsors

v9.13.1: pnpm 9.13.1

Patch Changes

Platinum Sponsors

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

`v9.15.9`: pnpm 9.15.9

`v9.15.8`: pnpm 9.15.8

`v9.15.7`: pnpm 9.15.7

`v9.15.6`: pnpm 9.15.6

`v9.15.5`: pnpm 9.15.5

`v9.15.4`: pnpm 9.15.4

`v9.15.3`: pnpm 9.15.3

`v9.15.2`: pnpm 9.15.2

`v9.15.1`: pnpm 9.15.1

`v9.15.0`: pnpm 9.15

`v9.14.4`: pnpm 9.14.4

`v9.14.3`: pnpm 9.14.3

`v9.13.2`: pnpm 9.13.2

`v9.13.1`: pnpm 9.13.1

`v9.13.0`: pnpm 9.13