CVE-2024-53866

Executive Summary

CVE-2024-53866 is a critical security vulnerability in the pnpm package manager (versions prior to 9.15.0) that allows workspace A to poison the global cache and execute arbitrary scripts in workspace B, even when ignore-scripts=true is set. This breaks the fundamental security expectation that ignore-scripts prevents immediate code execution during install operations. The vulnerability stems from pnpm's mishandling of overrides and global cache: overrides from one workspace leak into npm metadata stored in the global cache, and this poisoned metadata then affects other workspaces. Additionally, installs by default do not revalidate the data, including on first lockfile generation. This enables a supply chain attack where a malicious or compromised workspace can corrupt the global state, leading to arbitrary code execution in other workspaces during subsequent installs.

Supply Chain & Package Security

This vulnerability is particularly severe in the npm ecosystem because pnpm is a widely used package manager. The attack exploits the shared global cache, a common feature in package managers to improve performance. By poisoning the cache, an attacker can inject malicious scripts that execute in the context of another workspace, bypassing the ignore-scripts safeguard. This undermines the integrity of the entire supply chain, as developers often rely on ignore-scripts to safely inspect or repackage dependencies without executing them. The fix in version 9.15.0 ensures that overrides are scoped correctly and that cache data is validated per workspace.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack can be initiated remotely by providing a malicious workspace.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must install dependencies in a workspace.
• Scope (S): Changed (C) – The vulnerable component (pnpm) impacts resources beyond its security scope (other workspaces).
• Confidentiality (C): High (H) – Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High (H) – Cache poisoning allows injection of malicious data.
• Availability (A): High (H) – Code execution can disrupt services.

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability is easy to exploit, has a significant impact, and affects a widely used tool. The lack of a public PoC does not reduce the risk, as the attack vector is clear.

Deep Dive & Mechanics

The core issue is pnpm's handling of the global cache and workspace overrides. In pnpm, workspaces can define overrides to replace dependencies. These overrides are intended to be scoped to the workspace. However, due to a flaw, overrides from one workspace can leak into the npm metadata stored in the global cache. When another workspace installs dependencies, it reads this poisoned metadata, which may include malicious scripts or altered dependency trees.

The attack flow:

1. Workspace A (attacker-controlled) defines a malicious override (e.g., replacing a legitimate package with a malicious one that has a postinstall script).
2. When workspace A installs dependencies, pnpm writes the override-influenced metadata to the global cache.
3. Workspace B (victim) installs dependencies. pnpm reads the global cache and uses the poisoned metadata, even if workspace B has ignore-scripts=true.
4. The malicious script from the override executes in workspace B's context, leading to arbitrary code execution.

The vulnerability is exacerbated by the fact that pnpm does not revalidate cache data on installs, including first lockfile generation. This means the poisoned cache persists and affects all subsequent operations.

Vulnerable vs. Patched Code

Vulnerable (pre-9.15.0):

• Overrides are not scoped to the workspace when writing to the global cache.
• Cache data is not validated per workspace.
• ignore-scripts does not prevent execution of scripts from poisoned cache entries.

Patched (9.15.0):

• Overrides are properly scoped and do not leak into the global cache.
• Cache data is validated and isolated per workspace.
• ignore-scripts effectively prevents script execution, even from cache.

Example of vulnerable behavior (pseudocode):

// Vulnerable: Override leaks to global cache
function installWorkspace(workspace) {
  let metadata = fetchMetadata(workspace);
  applyOverrides(metadata, workspace.overrides);
  // Writes to global cache without workspace isolation
  globalCache.set(metadata);
}

Patched behavior:

// Patched: Override scoped to workspace
function installWorkspace(workspace) {
  let metadata = fetchMetadata(workspace);
  let scopedMetadata = applyOverrides(metadata, workspace.overrides);
  // Writes to workspace-specific cache
  workspaceCache.set(workspace.id, scopedMetadata);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Two pnpm workspaces (A and B) on the same machine.
• pnpm version < 9.15.0.
• Workspace A is attacker-controlled or compromised.

Steps:

1. Create workspace A with a pnpm-workspace.yaml and a malicious override.

   # pnpm-workspace.yaml
   packages:
     - 'packages/*'
   

   // package.json
   {
     "name": "workspace-a",
     "pnpm": {
       "overrides": {
         "lodash": "npm:malicious-package@1.0.0"
       }
     },
     "dependencies": {
       "lodash": "^4.17.21"
     }
   }
   

2. Create a malicious package (malicious-package) with a postinstall script that writes to a file or executes a command.

   // malicious-package/package.json
   {
     "name": "malicious-package",
     "version": "1.0.0",
     "scripts": {
       "postinstall": "echo 'PWNED' > /tmp/pwned.txt"
     }
   }
   

3. Run pnpm install in workspace A. This poisons the global cache.
4. In workspace B, run pnpm install (even with --ignore-scripts). The malicious script executes.

Blue Team

Detection:

• Monitor for unexpected file writes or process executions during pnpm installs.
• Check for discrepancies between workspace overrides and installed packages.
• Use file integrity monitoring on the global cache directory (typically ~/.pnpm-store).

Prevention:

• Upgrade to pnpm 9.15.0 or later.
• As a workaround, use separate cache and store directories for each workspace:

  pnpm config set store-dir ./pnpm-store
  pnpm config set cache-dir ./pnpm-cache
  

• Implement network segmentation to isolate workspaces.
• Use containerized environments for each workspace.

Indicators of Compromise (IOCs)

• File: /tmp/pwned.txt (or similar unexpected files)
• Process: Unexpected node or npm processes spawned during install
• Network: Connections to unknown or malicious package registries
• Cache: Modified entries in ~/.pnpm-store or global cache that do not match expected workspace overrides
• Logs: pnpm logs showing override application from unexpected sources

Detection Engineering

YARA Rule

rule pnpm_cache_poisoning {
  meta:
    description = "Detects potential pnpm cache poisoning by checking for override patterns in lock files"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "CVE-2024-53866"
  strings:
    $override = /"overrides"\s*:\s*\{[^}]*\}/
    $malicious = /"postinstall"\s*:\s*"[^"]*"/
  condition:
    $override and $malicious
}

Sigma Rule

title: Pnpm Cache Poisoning via Override Leak
id: cve-2024-53866
status: experimental
description: Detects potential exploitation of CVE-2024-53866 where overrides leak into global cache
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/pnpm'
    CommandLine|contains: 'install'
  condition: selection
falsepositives:
  - Legitimate use of overrides in isolated workspaces
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-53866 Pnpm Cache Poisoning Attempt"; flow:to_server; content:"pnpm"; http_uri; content:"override"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade pnpm to version 9.15.0 or later.
• If upgrade is not possible, use separate cache and store directories for each workspace:

  pnpm config set store-dir ./pnpm-store
  pnpm config set cache-dir ./pnpm-cache
  

Long-term:

• Implement workspace isolation at the filesystem level (e.g., containers).
• Regularly audit pnpm cache and lock files for unexpected overrides.
• Use pnpm audit to check for known vulnerabilities.
• Educate developers on the risks of shared caches and the importance of ignore-scripts.

Workaround:

• Set ignore-scripts=true globally and manually run scripts only in trusted environments.
• Use --filter to limit installs to specific workspaces.

Valters IT
DevSecOps & Cyber Threat Intelligence