Executive brief
fs-git is a Node.js library that provides a file system-like interface to interact with git repositories. The library contains a command injection vulnerability in its command-building logic that allows an attacker with local access to execute arbitrary system commands. This could lead to complete system compromise, including reading sensitive data or modifying repository contents.
Technical details
The vulnerability exists in the buildCommand method of fs-git, which constructs shell commands for execution via Node.js child_process.exec(). The method fails to properly sanitize user-supplied input before embedding it into shell commands, allowing OS command injection. An attacker with local access to code using this library can inject shell metacharacters through input parameters to execute arbitrary commands with the privileges of the Node.js process. The fix, released in version 1.0.2, implements proper input sanitization or uses safe APIs like child_process.execFile() that do not invoke a shell.
Affected products
- fs-git fs-git all versions before 1.0.2
Timeline
- 2018-01-02: disclosed: Published on NVD
- 2017-06-01: patched: Fix committed to repository
- 2022-05-13: advisory: GitHub advisory published