CVE-2020-7630: npm git-add-remote OS command injection via name argument

Executive brief

The git-add-remote package for Node.js is vulnerable to a critical security flaw that allows attackers to execute arbitrary commands on the underlying server. This package is used to automate the addition of remote repositories in Git workflows. An exploit could lead to a complete system takeover, unauthorized data access, or disruption of services.

Technical details

The git-add-remote npm package through version 1.0.0 contains an OS command injection vulnerability (CWE-78). The root cause is the improper neutralization of special elements within the 'name' argument passed to the library, which is subsequently used to construct a shell command. A remote attacker can exploit this by providing a maliciously crafted string as the repository name, leading to arbitrary command execution with the privileges of the Node.js process. As of the advisory date, no patched versions are available.

Affected products

• npm git-add-remote <= 1.0.0

Timeline

• 2020-04-02: disclosed: NVD publication date
• 2022-02-10: advisory: GitHub Advisory published

References

• https://api.github.com/users/cookesan
• https://github.com/cookesan
• https://api.github.com/users/cookesan/gists%7B/gist_id%7D
• https://api.github.com/users/cookesan/repos
• https://avatars.githubusercontent.com/u/6601329?v=4
• https://api.github.com/users/cookesan/events%7B/privacy%7D