CVE-2020-7619: npm get-git-data command injection

Executive brief

The get-git-data library, a tool used to retrieve information from Git repositories, contains a critical security flaw. An attacker can use this vulnerability to run unauthorized commands on the system where the software is installed. This could lead to a complete system takeover, theft of sensitive data, or disruption of operations.

Technical details

The get-git-data package for npm, up to and including version 1.3.1, is vulnerable to OS command injection (CWE-78). The vulnerability exists because the library fails to properly neutralize special elements in the arguments passed to it before executing them as part of a shell command. A remote attacker can exploit this by providing malicious input that includes shell metacharacters, allowing for arbitrary command execution on the host system with the privileges of the application. As of the latest advisory update, no patched version is available.

Affected products

• npm get-git-data <= 1.3.1

Timeline

• 2020-04-02: disclosed: NVD publication date
• 2021-05-10: advisory: GitHub Advisory published

References

• https://api.github.com/users/cookesan
• https://github.com/cookesan
• https://api.github.com/users/cookesan/gists%7B/gist_id%7D
• https://api.github.com/users/cookesan/repos
• https://avatars.githubusercontent.com/u/6601329?v=4
• https://api.github.com/users/cookesan/events%7B/privacy%7D