Arbitrary Command Execution in Hugo via TailwindCSS Configuration

Hugo versions 0.162.0 through 0.164.0 introduced a security regression involving the Node.js asset pipeline. While the project aimed to use the Node.js permission model to restrict access for build-time tools like PostCSS and Babel, the inclusion of 'tailwindcss' in the default AllowChildProcess configuration in 'config/security/securityConfig.go' undermined this protection.

The vulnerability arises because TailwindCSS executes the project-supplied 'tailwind.config.js' file at startup. An attacker providing a theme, module, or starter template containing a malicious 'tailwind.config.js' can leverage the permitted Node.js process to call 'child_process' functions. Because the resulting spawned process is not a Node process, it fails to inherit the restricted permission flags, executing instead with the full system privileges of the account running the Hugo build. Hugo 0.165.0 remediated this by removing 'tailwindcss' from the default allow-list.

Attack Chain

1. Attacker creates a malicious 'tailwind.config.js' file containing code designed to invoke 'child_process'.
2. Attacker bundles the malicious file within a Hugo theme, module, or starter template.
3. Victim downloads and initializes the malicious theme or module within their project directory.
4. Victim initiates a site build process using an affected version of Hugo (0.162.0 - 0.164.0).
5. Hugo launches the TailwindCSS process under the default Node.js permission model.
6. TailwindCSS, authorized by the default security config, executes the malicious 'tailwind.config.js' during the startup phase.
7. The script inside 'tailwind.config.js' uses 'child_process' to spawn an external shell or binary.
8. The spawned process executes with the full privileges of the user running the Hugo build, resulting in arbitrary command execution on the build host.

Impact

Successful exploitation results in arbitrary command execution on the system performing the site build. This impacts developers and CI/CD pipelines utilizing affected Hugo versions, potentially leading to unauthorized data exfiltration, local system compromise, or further lateral movement within build environments.

Recommendation

1. Upgrade Hugo to version 0.165.0 or later immediately to remove TailwindCSS from the default execution allow-list.
2. Audit projects, especially those utilizing third-party themes, modules, or templates, for the presence of suspicious code within 'tailwind.config.js'.
3. Implement build process monitoring to alert on anomalous child processes (e.g., shells or network tools) spawned by build-time Node.js processes.