Executive brief
pullit is a Node.js utility for checking out GitHub pull requests locally. Versions before 1.4.0 fail to validate git branch names, allowing an attacker to create a malicious pull request with a crafted branch name that injects arbitrary shell commands. When a user runs pullit and selects the malicious PR, those commands execute with the user's privileges.
Technical details
The vulnerability is a command injection flaw (CWE-77) in how pullit constructs git commands. The package concatenates unsanitized branch names into shell command strings passed to execSync(), rather than using argument arrays with execFileSync(). An attacker can create a remote branch with a name like ";{echo,hello,world}>/tmp/c" which, when processed by pullit, allows arbitrary command execution. The attack requires the attacker to push a malicious branch to GitHub and trick a user into selecting it via pullit's interactive menu. The fix, released in version 1.4.0, replaces execSync() with execFileSync() and passes git arguments as an array instead of a concatenated string.
Affected products
- pullit pullit <1.4.0
Timeline
- 2018-02-13: disclosed
- 2018: patched: Fixed in version 1.4.0
- 2020-09-03: advisory