Listen to this Post
The vulnerability in the `getTags()` API of the `@conventional-changelog/git-client` library stems from its failure to properly sanitize user-supplied parameters before passing them to the underlying `git log` command. Unlike the secure implementation in the `getRawCommits()` method, which uses the `–` POSIX convention to signal the end of command-line options and prevent argument injection, the `getTags()` function does not employ this safety measure. This omission allows an attacker to inject arbitrary command-line flags. By supplying a malicious parameter array containing the `–output=/path/to/file` flag, the attacker can redirect the output of the `git log` command to any arbitrary file on the filesystem, leading to a file overwrite vulnerability. The library’s lack of input validation, sanitization, or an allowlist for parameters enables this exploit.
Platform: Node.js
Version: <=1.0.1
Vulnerability: Argument Injection
Severity: Critical
date: 2024
Prediction: Patch Q2 2024
What Undercode Say:
`git log –tags –output=/etc/passwd`
`npm list @conventional-changelog/git-client`
`const params = [“–output=/tmp/exploit”];`
How Exploit:
Attacker controls `params` array.
Uses `–output=` flag.
Overwrites system files.
Protection from this CVE
Update library version.
Implement input sanitization.
Use `–` terminator.
Impact:
Arbitrary file overwrite.
Privilege escalation potential.
System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
