Skip to content

CRITICAL: Command injection via string concatenation in K8s provisioner #666

Description

@poyrazK

Why is this an issue?

Shell commands in internal/repositories/k8s/provisioner.go are built using unsafe string concatenation at lines 379, 510, 522, 629. This enables potential command injection if variables contain malicious content.

What is causing it?

exec.Run(ctx, "cat "+adminKubeconfig)
exec.Run(ctx, "kubectl --kubeconfig "+adminKubeconfig+" get nodes")

The code uses shellQuote() in other places but this pattern is inconsistently applied.

How can it be solved?

Use shellQuote() consistently or exec.Command() with separate arguments.

Category

  • Small
  • Medium
  • Large

Severity

  • Low
  • Medium
  • High
  • Critical

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions