Executive brief
fs-git is a Node.js library for programmatic Git operations. The buildCommand method fails to sanitize user-supplied input, allowing attackers to inject arbitrary shell commands and achieve remote code execution on systems using the library.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the fs-git library's buildCommand method, which constructs shell commands without proper input sanitization. An attacker can pass malicious strings to this method to inject arbitrary shell commands. The attack requires the attacker to control input passed to buildCommand, but no authentication is required. Successful exploitation results in arbitrary code execution with the privileges of the Node.js process. The vulnerability was fixed in version 1.0.2 via commit eb5f70e, which properly sanitizes command arguments.
Affected products
- vvakame fs-git before 1.0.2
Timeline
- 2017-06-01: disclosed: Fix committed by vvakame
- 2017-06-01: patched: Fixed in version 1.0.2