CVE-2024-47174

What it actually does

Missing TLS certificate verification in the builtin:fetchurl derivation builder allows man-in-the-middle interception of HTTPS connections, exposing full URLs and credentials from netrc or impureEnvVars while also permitting injection of arbitrary store objects during TOFU hash retrieval or impure derivations.

Why it matters to the business

Organizations relying on Nix for reproducible builds risk credential theft or supply-chain compromise through network attacks, potentially leading to unauthorized access, tampered dependencies, and disrupted package management workflows across Linux and Unix environments.

How an attack unfolds

An attacker on the same network positions themselves to intercept traffic, waits for Nix to perform an HTTPS fetch via fetchurl.nix or affected Nixpkgs mechanisms, presents a fraudulent certificate that is accepted due to missing validation, and either extracts authentication material or supplies malicious store objects that the client accepts as valid.

How to fix it

Upgrade nixos/nix to version containing commit 501a805fcd4a90e2bc112e9547417cfc4e04ca66 (equivalent to 2.18.8 or 2.24.8) and github.com/argoproj/argo-workflows/v3 to 3.0.9. As a workaround, switch to pkgs.fetchurl from Nixpkgs configured with impureEnvVars and curlOpts for authenticated fetches.

How to confirm the fix worked

Confirm Nix version is at least 2.18.8 or 2.24.8, test fetchurl derivations against known-good HTTPS endpoints with invalid certificates to ensure rejection, and review netrc/impureEnvVars usage for continued exposure.

Typical attack path

1. Establish network position for traffic interception
2. Trigger or observe Nix fetch operations using builtin:fetchurl or TOFU workflows
3. Present spoofed TLS certificate during HTTPS handshake
4. Extract credentials from netrc files or environment variables
5. Inject arbitrary or malicious store objects accepted by the client

How to detect it

Review build logs for fetchurl operations lacking certificate validation warnings, inspect netrc access timestamps during package fetches, and correlate unexpected store object additions with network MITM indicators such as anomalous TLS handshakes.

What your security team should do

• Immediately upgrade all Nix installations to the fixed versions
• Audit and restrict use of netrc files and impureEnvVars in derivations
• Prefer pkgs.fetchurl from Nixpkgs for new dependency fetching
• Monitor network paths used by build agents for unexpected certificate errors or store injections