Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead to remote code execution. We believe this vulnerability affects multiple package managers across multiple languages, including but not limited to: Python/pip, .NET/NuGet, Java/Maven, JavaScript/npm.
Attack scenarios
An attacker could take advantage of this ecosystem-wide issue to cause harm in a variety of ways. The original attack scenarios were discovered by Alex Birsan and are detailed in their whitepaper, Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies.
With basic knowledge of the target ecosystems, an attacker could create an empty shell for a package and insert malicious code in the install scripts, give it a high version, and publish it to the public repository. Vulnerable victim machines will download the higher version of the package between the public and private repositories and attempt to install it. Due to code incompatibility it will probably error out upon import or upon compilation, making it easier to detect; however the attacker would have gained code execution by that point.
An advanced attacker with some inside knowledge of the target could take a copy of a working package, insert the malicious code (in the package itself or in the install), and then publish it to a public repository. The package will likely install and import correctly, granting the attacker an initial foothold and persistence.
These two methods could affect target organizations at any of these various levels:
This remote code execution vulnerability can only be addressed by reconfiguring installation tools and workflows, and not by correcting anything in the package repositories themselves. See the FAQ section of this CVE for configuration guidance.
## Which versions are affected by CVE-2021-24105? It affects 1 product. Products: Microsoft Package Manager Configurations. ## How do I fix CVE-2021-24105? No fix has been published for CVE-2021-24105 yet. Limit exposure of the affected software until one is available. ## Is CVE-2021-24105 being exploited? There is no known exploitation of CVE-2021-24105 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2021-24105 and fix it if it is affected. What it is: CVE-2021-24105 is a high-severity vulnerability in Microsoft Package Manager Configurations, published on 25 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2021-24105 in the wild and no public exploit code. Affected product: Microsoft Package Manager Configurations. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2021-24105/ (Markdown: https://insights.sbomify.com/CVE-2021-24105/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2021-24105 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-24105 - OSV: https://osv.dev/vulnerability/CVE-2021-24105 --- From sbomify Insights: https://insights.sbomify.com/CVE-2021-24105/ Summaries are generated and may contain mistakes; the official description above is the record.