Executive brief
push-dir is a Node.js library used to push directories to Git repositories. The library fails to validate the branch name parameter before passing it to git commands, allowing an attacker to inject arbitrary OS commands and achieve remote code execution on systems using the library.
Technical details
push-dir through version 0.4.1 contains an OS command injection vulnerability (CWE-78) in the handling of the opt.branch parameter. The vulnerable code at index.js#L139 passes the unsanitized branch parameter directly to a git command executed via child_process without proper escaping or validation. An attacker who can control the branch parameter input can inject arbitrary shell commands. The attack requires no authentication or user interaction—any code calling the push-dir function with attacker-controlled options is vulnerable. A successful exploit results in arbitrary command execution with the privileges of the Node.js process.
Affected products
- L33T-KR3W push-dir through 0.4.1
Timeline
- 2022-02-09: disclosed