Listen to this Post
The vulnerability in git-commiters arises from its insecure use of the `child_process.exec` function. The `gitCommiters(options, callback)` API function constructs a shell command by directly concatenating user-controlled input from the `options.revisionRange` parameter without any sanitization. When a value like `HEAD; touch /tmp/pwn; ` is provided, it is inserted into the command string. The `exec` function then launches a shell process, which interprets the semicolons as command separators. This causes the shell to execute the intended `git log` command followed by the malicious `touch /tmp/pwn` command. The trailing “ character comments out any remaining parts of the original command, ensuring the Git operation still completes normally and hides the injection.
Platform: npm
Version: <=0.1.1
Vulnerability: Command Injection
Severity: Critical
date: 2020-05-30
Prediction: 2020-06-15
What Undercode Say:
npm ls git-commiters cat package.json | grep git-commiters
// Vulnerable code pattern
const { exec } = require('child_process');
exec('git log ' + userInput); // Critical vulnerability
// Secure code fix
const { execFile } = require('child_process');
execFile('git', ['log', userInput], (error, stdout) => { / ... / });
How Exploit:
Exploit requires controlling the `revisionRange` option. The payload is injected into a shell command executed by the library, allowing arbitrary command execution on the host system with the privileges of the Node.js process.
Protection from this CVE:
Upgrade to version 0.1.2 or later, which uses `execFile` to avoid shell metacharacter interpretation. Implement input validation and sanitization for all user-supplied parameters used in command execution. Use child_process functions that do not spawn a shell, such as `execFile` or spawn.
Impact:
Critical severity. Successful exploitation leads to remote code execution on the server hosting the vulnerable application, potentially resulting in full compromise of the application and underlying host.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
