Remote code execution in Binderhub

Vulnerability

A remote code execution vulnerability exists in BinderHub, a Kubernetes-based service for sharing reproducible interactive computing environments. The flaw resides in the GitRepoProvider class within binderhub/repoproviders.py. The git ls-remote command is called without using -- to separate options from positional arguments, allowing an attacker to inject additional command-line options by providing maliciously crafted input as the unresolved ref. Affected versions are those prior to 0.2.0-n653 [1][2].

Exploitation

An attacker needs only to provide a crafted repository URL or reference that includes injected options for the git ls-remote command. Since the user-supplied input is not properly sanitized, the attacker can pass arbitrary flags to git ls-remote, potentially executing arbitrary commands. No authentication is required, as the vulnerability is triggered during the normal repository resolution process when BinderHub processes a user-provided repository specification [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the BinderHub context. This can lead to exfiltration of sensitive credentials, including JupyterHub API tokens, Kubernetes service accounts, and Docker registry credentials. An attacker could then manipulate images and user-created pods in the deployment, with the potential for privilege escalation to the host depending on the underlying Kubernetes configuration. The confidentiality, integrity, and availability of the deployment are all at risk [1][2].

Mitigation

Users should update to version 0.2.0-n653, which includes the fix. The patch inserts -- before the positional arguments in the git ls-remote command, preventing option injection [2]. For users unable to upgrade, a workaround is to disable the git repo provider by setting the BinderHub.repo_providers configuration to exclude GitRepoProvider [1][3]. No EOL status or KEV listing has been reported.