Executive brief
gitlogplus is a Node.js library used to parse Git logs. A security flaw allows an attacker to execute unauthorized operating system commands on the server where this library is running. This could lead to a complete system takeover, data theft, or the deletion of critical files.
Technical details
All versions of the gitlogplus npm package are vulnerable to OS command injection (CWE-78/CWE-77). The vulnerability exists in the main functionality where 'options' attributes are concatenated into a Git command string and executed via the shell without proper sanitization or escaping. An attacker who can control the input to these options (such as the 'number' or 'repo' fields) can inject malicious shell commands using command separators like semicolons. This can result in full remote code execution (RCE) with the privileges of the Node.js process. As of the latest advisory, there is no known patch available.
Affected products
- gitlogplus_project gitlogplus All versions up to and including 3.1.7
Timeline
- 2021-07-02: disclosed: Vulnerability disclosed via HackerOne and Snyk.
- 2021-07-23: advisory: NVD and Snyk published advisories.
- 2021-07-26: advisory: GitHub Advisory Database entry published.