CVE-2024-47829

Executive Summary

CVE-2024-47829 is a vulnerability in the pnpm package manager, affecting versions prior to 10.0.0. The core issue lies in the path shortening function, which uses the MD5 hash algorithm to generate storage paths for packages. Due to MD5's known collision weaknesses, two different libraries can be assigned the same storage path, leading to a potential hash collision. This can result in package confusion, where one library's files are overwritten or replaced by another's, potentially leading to supply chain attacks or integrity violations. The CVSS score is 6.5 (Medium), with a high impact on integrity but no impact on confidentiality or availability. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating a low likelihood of exploitation in the wild.

Supply Chain & Package Security

As pnpm is a package manager for the Node.js ecosystem (NPM), this vulnerability directly impacts the software supply chain. A hash collision in the path shortening function could allow an attacker to craft a malicious package that collides with a legitimate package's storage path. This could lead to the malicious package being loaded instead of the intended one, potentially executing arbitrary code or exfiltrating sensitive data during installation or runtime. The integrity of the entire dependency tree is at risk, making this a critical supply chain security concern.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: High (I:H) – Package files can be overwritten or replaced.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for supply chain attacks and the difficulty of detection make this a significant threat for environments relying on pnpm for dependency management.

Deep Dive & Mechanics

The vulnerability resides in pnpm's path shortening function, which is used to generate unique storage paths for packages in the store (e.g., ~/.pnpm-store). The function uses the MD5 hash of the package name and version to create a shortened directory name. MD5 is cryptographically broken and susceptible to collision attacks, where two different inputs produce the same hash output.

Mechanism:

1. When pnpm installs a package, it computes a storage path using md5(package_name + version).
2. If an attacker can create a package with a different name/version that produces the same MD5 hash, the two packages will share the same storage path.
3. During installation, the second package's files will overwrite the first package's files in the shared directory.
4. When the first package is required, pnpm may load the malicious files instead of the legitimate ones.

Impact: This can lead to arbitrary code execution, dependency confusion, or data corruption. The attack is particularly dangerous in CI/CD pipelines or multi-tenant environments where packages from different sources are installed.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 10.0.0):

// Path shortening function using MD5
function shortenPath(packageName, version) {
  const hash = crypto.createHash('md5').update(packageName + version).digest('hex');
  return path.join(storeDir, hash);
}

Patched Code (10.0.0):

// Path shortening function using SHA-256 (collision-resistant)
function shortenPath(packageName, version) {
  const hash = crypto.createHash('sha256').update(packageName + version).digest('hex');
  return path.join(storeDir, hash);
}

The patch replaces MD5 with SHA-256, which is currently collision-resistant and provides a much larger hash space, effectively eliminating the collision risk.

Exploitation & Lab Setup

Red Team

Prerequisites:

• pnpm version < 10.0.0 installed.
• Ability to publish or host a malicious package (e.g., on a private registry or via a typosquatting attack).

Exploitation Steps:

1. Identify a legitimate package with a known MD5 hash of its name+version.
2. Craft a malicious package with a different name/version that produces the same MD5 hash.
3. Publish the malicious package to a registry accessible to the target.
4. When the target installs the malicious package (e.g., via pnpm install), it will overwrite the legitimate package's files in the store.
5. The next time the legitimate package is required, the malicious code executes.

Example (Conceptual):

# Assume legitimate package "safe-lib@1.0.0" has MD5 hash "abc123"
# Create malicious package "evil-lib@2.0.0" with same MD5 hash
# Publish to registry
# Target runs: pnpm install evil-lib@2.0.0
# This overwrites safe-lib's files in the store

Blue Team

Detection:

• Monitor for unexpected package installations or updates in pnpm store.
• Use file integrity monitoring (FIM) to detect changes to package files.
• Enable audit logging on package registries.

Prevention:

• Upgrade to pnpm version 10.0.0 or later.
• Use a private registry with strict package verification.
• Implement dependency pinning and lock files (e.g., pnpm-lock.yaml).

Hunting:

• Search for packages with identical MD5 hashes in the store.
• Check for anomalies in package file sizes or timestamps.

Indicators of Compromise (IOCs)

• File Paths: ~/.pnpm-store/*/ directories with unexpected file modifications.
• Hashes: MD5 collisions between different package name+version combinations.
• Network: Connections to suspicious package registries.
• Process: pnpm install commands installing packages from untrusted sources.

Detection Engineering

YARA Rule

rule pnpm_md5_collision {
  meta:
    description = "Detects pnpm store directories with potential MD5 collision"
    author = "Valters IT"
    date = "2024-10-27"
    reference = "CVE-2024-47829"
  strings:
    $md5_usage = "md5" nocase
    $pnpm_store = ".pnpm-store" nocase
  condition:
    $md5_usage and $pnpm_store
}

Sigma Rule

title: Potential pnpm MD5 Collision Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects pnpm installations that may exploit MD5 collision vulnerability
author: Valters IT
date: 2024-10-27
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-47829
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/pnpm'
    CommandLine|contains: 'install'
  condition: selection
falsepositives:
  - Legitimate pnpm install operations
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47829 - pnpm MD5 Collision Exploitation"; flow:to_server,established; content:"pnpm"; http_client_body; content:"install"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pnpm to version 10.0.0 or later: npm install -g pnpm@latest
2. Verify the integrity of existing package stores: pnpm store status
3. Clear and rebuild the store if any anomalies are found: pnpm store prune && pnpm install

Long-term Mitigations:

• Use a package registry with hash verification (e.g., npm registry with integrity checks).
• Implement dependency scanning tools to detect known vulnerable packages.
• Enforce the use of lock files (pnpm-lock.yaml) to pin dependency versions.
• Monitor for CVEs related to pnpm and other package managers.

Workarounds:

• If upgrade is not possible, avoid installing packages from untrusted sources.
• Use a virtual machine or container with isolated storage for package installations.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert