←back to thread

171 points irke882 | 1 comments | | HN request time: 0.227s | source
Show context
codebastard ◴[] No.44507439[source]
So the attack vector is:

- You have access to my file system

- You have access to the helm repository

You place malicious binaries outside the helm directory. Helm will now execute malicious code through the helm chart pointing outside the helm directory.

Don't I have already bigger problems if you have access to my file system to place there malicious code?

Is the danger here that one can get an execute permission? But if you can manipulate my helm chart why can you not also place the malicious code in the helm directory?

replies(4): >>44508017 #>>44508211 #>>44508268 #>>44512978 #
1. romaaeterna ◴[] No.44508268[source]
> You place malicious binaries outside the helm directory

No, helm is the one doing this part in the vuln. Chart.lock is made a symlink to some important file, and helm will happily write to it.