Executive brief
HashBrown CMS is a headless content management system used to manage website content independently from its presentation layer. The system includes a Git deployer feature that automatically pulls repository updates when triggered. A vulnerability in versions 1.3.3 and earlier fails to properly validate git URLs and credentials, allowing attackers to inject and execute arbitrary system commands on the server hosting the CMS, potentially leading to complete system compromise.
Technical details
The vulnerability exists in Server/Entity/Deployer/GitDeployer.js where user-supplied parameters (git URL, repository path, username, password) are concatenated directly into a shell command executed via HashBrown.Service.AppService.exec() without sanitization. The vulnerable code constructs a git clone command by string concatenation: `git clone '' + url + '' '' + repoPath + ''`. An attacker can craft a malicious git URL containing shell metacharacters (e.g., backticks, dollar signs, semicolons) to break out of the git command context and execute arbitrary bash commands with the privileges of the CMS process. The attack vector is network-based with no authentication required; an attacker simply needs to trigger the git pull functionality through the media interface. The impact is unauthenticated remote code execution. The vulnerability was fixed in version 1.3.4 with proper input validation and parameterized command execution.
Affected products
- HashBrown HashBrown CMS through 1.3.3
Timeline
- 2020-01-12: disclosed: Vulnerability reported on GitHub issue #326
- 2020-01-14: patched: Fix committed to repository in version 1.3.4
- 2022-05-24: advisory: GHSA advisory published