Executive brief
The gitblame library is a Node.js package used to identify who modified specific lines in a file by interfacing with Git. A security flaw allows an attacker to execute unauthorized commands on the underlying server by providing a specially crafted filename. This could lead to a complete system takeover, data theft, or disruption of services.
Technical details
A command injection vulnerability exists in the gitblame package due to the insecure use of the 'child_process.exec' function in 'lib/gitblame.js'. The library concatenates user-supplied filenames directly into a shell command string ('git blame ' + filename) without proper sanitization or escaping. An attacker can exploit this by passing a filename containing shell metacharacters (e.g., ';', '&', or '|') to execute arbitrary commands with the privileges of the Node.js process. This affects all versions of the package, including the latest version 0.1.1, and no official patch is currently available.
Affected products
- xjamundx gitblame All versions up to 0.1.1
Timeline
- 2020-11-21: disclosed: Vulnerability identified and CVE-2020-28434 assigned
- 2021-01-26: advisory: Snyk published advisory SNYK-JS-GITBLAME-1050430
- 2022-08-03: advisory: GitHub Advisory GHSA-3486-rvxc-hrrj published