Nuclio Java Runtime Build-time RCE Fix & Whitelist Validation PoC

Vulnerability Overview Vulnerability Type: A Build-time Remote Code Execution (Build-time RCE) vulnerability exists in the field of the Java runtime configuration ( ). Root Cause: Values in the field are not sufficiently validated before being written to the script. Attackers can construct malicious repository names (e.g., , , , etc.) or inject Groovy expressions to execute arbitrary code during the Gradle build phase. Scope of Impact: - Affects all build processes that use configuration and allow users to customize . - Attack surface includes: special characters in repository names, method call chains, string concatenation, etc. - Affected versions: Versions prior to commit in the repository. Fix Details Core Fix: Perform whitelist validation on each repository name before the field of is written to . Only allow predefined valid repository names (e.g., , , , ). Validation Logic: - Use the regular expression to validate repository names, rejecting complex expressions containing special characters, method calls, string concatenation, etc. - Apply to each value in the field to prevent parsing exceptions caused by leading/trailing spaces. - If a repository name is not in the whitelist, throw an and log the event. Code Changes: - Added a function in to perform regex-based validation of repository names. - Added test cases in covering valid/invalid repository name scenarios. POC / Exploit Code ```go // The newly added test cases in java/runtime/java_types_test.go func TestValidateRepositoryName(t *testing.T) { tests := []struct { name string wantErr bool }{ {"mavenCentral", false}, {"jcenter", false}, {"google", false}, {"mavenLocal", false}, {"mavenCentral()", true}, // Method call is rejected {"mavenCentral", false}, {"mavenCentral ", false}, // Valid after trimming leading/trailing spaces {"mavenCentral()", true}, // Method call is rejected {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"mavenCentral", false}, {"ma

Goal Reached Thanks to every supporter — we hit 100%!

Nuclio Java Runtime Build-time RCE Fix & Whitelist Validation PoC

More from this source