Microsoft PowerShell Gallery vulnerable to spoofing, supply chain attacks

Lax policies for package naming on Microsoft’s PowerShell Gallery code repository allow threat actors to perform typosquatting attacks, spoof popular packages and potentially lay the ground for massive supply chain attacks.

PowerShell Gallery is a Microsoft-run online repository of packages uploaded by the wider PowerShell community, hosting a large number of scripts and cmdlet modules for various purposes.

It is a very popular code hosting platform, and some packages on it count tens of millions of monthly downloads.

Aqua Nautilus discovered the problems in the market’s policies in September 2022 and even though Microsoft has acknowledged the reception of the corresponding bug reports and PoC exploits, it has not taken action to remediate the flaws.

Easy spoofing

AquaSec's Nautilus team discovered that users can submit to the PS Gallery packages with very similar names to existing repositories, so-called 'typosquatting' when cybercriminals leverage it for malicious purposes.

A proof-of-concept (PoC) example in the report refers to the popular “AzTable” module - with a download count of 10 million, which could be easily impersonated with a new name like 'Az.Table', making it difficult for users to distinguish between them.

Another problem the researchers discovered is the ability to spoof module details, including Author and Copyright, by copying them from legitimate projects.

Not only would this make the first issue of package typosquatting even more dangerous, but it can also be abused to make arbitrary packages appear as the work of trustworthy publishers.

Furthermore, PS Gallery hides by default the more reliable ‘Owner’ field under ‘Package Details’, which shows the publisher account that uploaded the package.

Spoofed package (left) and real module (right)
source: AquaSec

Exposing hidden packages

A third flaw discovered by AquaSec concerns the ability to expose unlisted packages/modules on the platform, which are normally not indexed by the Gallery’s search engine.

To the researchers' surprise, they found on the platform an XML file that provided comprehensive details about both listed and unlisted packages.

“By utilizing the API link located at the bottom of the XML response [...], an attacker can gain unrestricted access to the complete PowerShell package database, including associated versions.” explains AquaSec's Nautilus team.

“This uncontrolled access provides malicious actors with the ability to search for potentially sensitive information within unlisted packages.”

API key of a big tech firm exposed on the unlisted project (AquaSec)

Disclosure and mitigation

AquaSec reported all flaws to Microsoft on September 27, 2022, and were able to replicate them on December 26, 2022, despite Microsoft stating in early November that they had fixed the issues.

On January 15, 2023, Microsoft stated that a short-term solution was implemented until its engineers developed a fix for the name typosquatting and package details spoofing.

AquaSec says that on August 16 they the flaws still persisted, indicating that a fix has not been implemented.

Users of the PS Gallery repository are advised to adopt policies that allow execution of only signed scripts, utilize trusted private repositories, regularly scan for sensitive data in module source code, and implement real-time monitoring systems in cloud environments to detect suspicious activity.

BleepingComputer has contacted Microsoft with a request for a comment on AquaSec’s findings, and we will update this post as soon as we hear back.