Executive brief
git-diff-apply is a Node.js library used to apply diffs to git repositories. An attacker can inject arbitrary OS commands through an unsanitized remoteUrl parameter, allowing complete compromise of systems using this library. This is particularly dangerous in automation and CI/CD environments where this tool may be deployed.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in index.js line 240, where the git command is constructed using an unsanitized user-controlled remoteUrl parameter. The remoteUrl is directly interpolated into a shell command without proper escaping or validation. An unauthenticated attacker can supply a malicious remoteUrl containing shell metacharacters or command separators to execute arbitrary commands with the privileges of the process. The fix, applied in version 0.22.2, uses spawn() instead of shell command execution to prevent command injection.
Affected products
- Kelly Selden git-diff-apply < 0.22.2
Timeline
- 2020-02-14: disclosed: Published to GitHub Advisory Database
- 0.22.2: patched: Fixed via spawn() to prevent command injection