Executive brief
@graphql-tools/git-loader is a library that loads GraphQL schemas from Git repositories. The library improperly handles user-supplied input when executing system commands, allowing attackers to inject arbitrary shell commands and achieve remote code execution on systems running vulnerable versions.
Technical details
A command injection vulnerability exists in @graphql-tools/git-loader due to unsafe use of exec and execSync functions in load-git.ts. The vulnerable code fails to properly sanitize user-supplied input before passing it to shell command execution, violating CWE-77 (Improper Neutralization of Special Elements used in a Command). An attacker can inject shell metacharacters through repository URLs or other parameters to execute arbitrary commands with the privileges of the running process. The vulnerability requires user interaction (loading a malicious repository). The fix, released in version 6.2.6, replaces exec/execSync with execFile, which does not invoke a shell interpreter.
Affected products
- graphql-tools @graphql-tools/git-loader before 6.2.6
Timeline
- 2021-01-29: disclosed: Public advisory published
- 2021-01-13: patched: Fix merged in version 6.2.6