Executive brief
gitlog is a Node.js library for parsing git logs. A command injection vulnerability in the gitlog function allows attackers to execute arbitrary shell commands by providing malicious input. An attacker who can control the input to gitlog (e.g., through a malicious repository name or git parameters) can gain full code execution on the server running the application.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the gitlog function located in src/index.ts. The root cause is unsafe use of shell execution functions (exec/execSync) with unsanitized user input, allowing shell metacharacters to be interpreted. The vulnerability requires no authentication and is network-reachable if gitlog is exposed via a web service. An unauthenticated attacker can achieve remote code execution by crafting malicious input that breaks out of the intended command context. The fix was implemented in version 4.0.4 by replacing exec/execSync with execFile/execFileSync, which do not invoke a shell interpreter.
Affected products
- domharrington gitlog before 4.0.4
Timeline
- 2021-02-08: disclosed: NVD published
- 2020-12-17: patched: Patch merged in PR #65
- 2021-04-13: advisory: GHSA advisory published