来源

关联漏洞

描述

CVE-2025-53547 one of poc code

介绍

# CVE-2025-53547 POC

this is a poc for CVE-2025-53547

`Chart.lock` links test file to /tmp/1.txt

/tmp/1.txt inject a command that create /tmp/2.txt

In real product enviroment, you can change `Chart.lock` link file to inject any command you want such as:

* /root/.bash_rc
* /root/.bash_profile
* /etc/profile
......

or any can run shell script file.

then change the `Chart.yaml` dependency repository url params to run other command.

## Usage

helm <= 3.18.3


first run

```bash
helm dependency update
```

then you'll find `/tmp/1.txt` 

then run

```bash
bash /tmp/1.txt
```

then you'll find `/tmp/2.txt`


## Reference

https://github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm
https://github.com/helm/helm/compare/v3.18.3...v3.18.4

文件快照

 [4.0K]  /data/pocs/13c73bac84bd0a138bd0b9de3a28de9f80accfd7
├── [  10]  Chart.lock -> /tmp/1.txt
├── [ 423]  Chart.yaml
└── [ 756]  README.md

0 directories, 3 files

备注