Skip to content

Commit 958310e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pfq2-hh62-7m96 GHSA-vrgw-pc9c-qrrc
1 parent 4b1ec2e commit 958310e

2 files changed

Lines changed: 119 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-pfq2-hh62-7m96/GHSA-pfq2-hh62-7m96.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pfq2-hh62-7m96",
4+
"modified": "2026-01-13T19:54:29Z",
5+
"published": "2026-01-13T19:54:29Z",
6+
"aliases": [],
7+
"summary": "Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`",
8+
"details": "### Summary\nRenovate can be tricked into executing shell code while updating the Gradle Wrapper. A malicious `distributionUrl` in `gradle/wrapper/gradle-wrapper.properties` can lead to command execution in the Renovate runtime.\n\n### Details\nWhen Renovate handles Gradle Wrapper artifacts, it may run a wrapper update command such as:\n- `./gradlew :wrapper --gradle-distribution-url <value>`\n\nIn the observed behavior, Renovate executes this via a shell (e.g., `/bin/sh -c ...`). \nIf `distributionUrl` contains shell command substitution syntax like `$(...)`, the shell evaluates it **before** Gradle validates/parses the URL.\n\nAfter that, Gradle attempts to parse the URL as a URI and fails with `URISyntaxException`, but the shell substitution has already executed.\n\nThis is reproducible even when `allowScripts` is disabled (default is OFF), because this execution happens as part of Gradle Wrapper artifact handling rather than “repository install scripts”.\n\nPrerequisites / attack conditions:\n- The attacker must be able to get a malicious `gradle-wrapper.properties` into a repository that Renovate scans (e.g., direct write access, or a maintainer merges an attacker’s change/PR).\n- Renovate must be configured to process Gradle Wrapper updates/artifacts for that repository (default behavior for the Gradle Wrapper manager).\n\n### PoC\n1. Create a repository with a Gradle Wrapper (`gradlew`, `gradlew.bat`, `gradle/wrapper/gradle-wrapper.jar`, and `gradle/wrapper/gradle-wrapper.properties`).\n2. Set `distributionUrl` in `gradle-wrapper.properties` to include `$(...)`.\n3. Run Renovate against the repository.\n4. Observe that a file is created during Renovate’s wrapper update step **before** Gradle fails with `URISyntaxException`.\n\nA [screen recording](https://drive.google.com/file/d/1nveSCgyz4pKPCZuelqDD_xGEO00DXr4P/view) is attached showing end-to-end reproduction. In the demo, the payload creates `/tmp/passwd_dump` containing `/etc/passwd`, demonstrating that file read/exfiltration is possible within the Renovate execution context.\n\n### Impact\nThis allows arbitrary command execution in the Renovate runtime during Gradle Wrapper updates. Depending on deployment, this may expose credentials/tokens available to the bot and may allow an attacker to modify repositories or access internal resources reachable from the Renovate environment.\n\n### Remediation\n\nUpgrading to Renovate [42.68.5](https://github.com/renovatebot/renovate/releases/tag/42.68.5) (2025-12-31) fixes this issue, and closes out other risks of shell evaluation for commands run by Renovate.\n\nIf using the `composer`, `yarn` (v1) or `flux` managers, please upgrade to [42.74.5](https://github.com/renovatebot/renovate/releases/tag/42.74.5) (2026-01-08), as there were follow-up fixes to keep these managers working.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "renovate"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "32.124.0"
27+
},
28+
{
29+
"fixed": "42.68.5"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/renovatebot/renovate"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/renovatebot/renovate/releases/tag/42.68.5"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-78"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-01-13T19:54:29Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/01/GHSA-vrgw-pc9c-qrrc/GHSA-vrgw-pc9c-qrrc.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vrgw-pc9c-qrrc",
4+
"modified": "2026-01-13T19:54:05Z",
5+
"published": "2026-01-13T19:54:05Z",
6+
"aliases": [
7+
"CVE-2025-68924"
8+
],
9+
"summary": "UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation",
10+
"details": "### Impact\nWithin Umbraco Forms, configuring a malicious URL on the Webservice data source can result in Remote Code Execution. This affects all Umbraco Forms versions running on .NET Framework (up to and including version 8).\n\n### Patches\nThe affected Umbraco Forms versions are all End-of-Life (EOL) and not supported anymore, hence no patches will be released. Upgrading to any of the currently supported versions (v13, v16 or v17) is recommended.\n\n### Workarounds\nIf none of the configured Forms data sources uses the Webservice type, it can be safely excluded by adding the following code to the application. This will completely remove the option to select/use this data source within the Backoffice and thereby mitigate the vulnerability.\n\n```c#\nusing Umbraco.Core.Composing;\nusing Umbraco.Forms.Core.Providers;\nusing Umbraco.Forms.Core.Providers.DatasourceTypes;\n\ninternal sealed class RemoveFormsWebserviceDataSourceTypeComposer : IUserComposer\n{\n public void Compose(Composition composition)\n => composition.WithCollectionBuilder<DataSourceCollectionBuilder>().Exclude<Webservice>();\n}\n```\n\nAny Webservice data source that is configured and still in use should be replaced with a custom implementation instead, before applying the above code. If this is not feasible, the vulnerability can be minimized by revoking the 'Manage Data Sources' from any non-administrator user and/or inheriting from the default `Umbraco.Forms.Core.Providers.DatasourceTypes.Webservice` class and overriding the `ValidateSettings()` method to ensure only trusted URLs can be used.\n\n### References\nWhen upgrading to a supported version, please take the Forms [version specific upgrade notes](https://docs.umbraco.com/umbraco-forms/13.latest/upgrading/version-specific) into account and check the [CMS upgrade documentation](https://docs.umbraco.com/umbraco-cms/13.latest/fundamentals/setup/upgrading). Content and schema can also be migrated straight to the latest version using [Deploy export/import with migrations](https://docs.umbraco.com/umbraco-deploy/13.latest/deployment-workflow/import-export).\n\nImplementation details on data sources are not extensively documented, but they follow the general Forms [provider model](https://docs.umbraco.com/umbraco-forms/13.latest/developer/extending/adding-a-type) and inherit from `Umbraco.Forms.Core.FormDataSource`.\n\nA special thanks to Piotr Bazydlo (@chudyPB) of watchTowr for finding and disclosing this vulnerability",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "NuGet",
21+
"name": "UmbracoForms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "8.13.16"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-vrgw-pc9c-qrrc"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/umbraco/Umbraco.Forms.Issues"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-502",
51+
"CWE-829",
52+
"CWE-915",
53+
"CWE-94"
54+
],
55+
"severity": "CRITICAL",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-01-13T19:54:05Z",
58+
"nvd_published_at": null
59+
}
60+
}

0 commit comments

Comments
 (0)