security: CWE-95: Helm template injection prevention — VC-53728

[torresashjiancyber]

Summary

Mitigates CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) by using --set-string instead of --set for string values in Helm commands to prevent Go template injection.

Finding

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (Injection)

The CCM (Cluster Configuration Manager) and agent installation scripts evaluated Helm chart values using --set with user-supplied or environment-based values without sanitization. This allowed potential injection of arbitrary Go template directives (e.g., {{ exec "cmd" }}) when chart values were derived from user input or external sources.

CVSS: 7.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

Remediation

Changed --set to --set-string for all string-valued Helm chart parameters in:

• projects/nginx-plus/01.install-nginx.sh
• projects/discovery-context/discovery-svc.sh
• projects/ccm-agent/ccm_agent_oidc.sh
• projects/cert-discovery/Makefile

Boolean values (e.g., controller.nginxplus=true, crds.venafiConnection.include=true) remain as --set since they require boolean type interpretation.

Using --set-string treats values as literal strings and prevents Helm from interpreting them as Go templates, effectively blocking template injection attacks while maintaining functional equivalence for string parameters.

Verification

• All string parameters now use --set-string
• Boolean parameters correctly retain --set
• Changes are minimal and focused on the vulnerability
• No functional changes to the deployment logic

🤖 Generated with Pattern-C security remediation