Executive brief
giting is a Node.js package that provides Git server functionality for managing repositories. Versions before 0.0.8 fail to validate the branch parameter in the pull() function, allowing attackers to inject arbitrary shell commands that execute with the privileges of the application, potentially leading to complete system compromise.
Technical details
This is an OS command injection vulnerability (CWE-78) in the giting npm package. The vulnerable code concatenates user-supplied input (the repo.branch parameter) directly into shell commands passed to child_process.exec() without any escaping or validation. An attacker who can control the repo object passed to the pull() function can inject shell metacharacters (e.g., semicolons, pipes) to execute arbitrary commands. The vulnerability affects multiple functions within the package (pull, fetch, checkout). The fix involves using encodeURIComponent() to escape the branch parameter before shell execution. Attack vector is network if the application exposes this functionality remotely, with no authentication or user interaction required. The vulnerability was patched in version 0.0.8.
Affected products
- npm giting <0.0.8
Timeline
- 2020-02-28: disclosed
- 2020-01-29: patched: Fix committed to repository