Executive brief
async-git is a Node.js library for executing git commands programmatically. The library fails to properly sanitize user input passed to git methods like reset and tag, allowing attackers to inject arbitrary shell commands. If an application uses async-git and passes untrusted input to these methods, an attacker could execute arbitrary code on the server.
Technical details
The async-git library before version 1.13.2 contains an OS command injection vulnerability (CWE-78) in methods like git.reset() and git.tag(). The vulnerability arises from insufficient input validation when constructing shell commands, allowing shell metacharacters in user-supplied arguments to break out and execute arbitrary commands. The attack vector is network-based if the vulnerable library is used by a web service, and requires no authentication or user interaction. An attacker can achieve remote code execution with the privileges of the process running Node.js. The fix was released in version 1.13.2; input sanitization should be applied as a workaround.
Affected products
- npm async-git before 1.13.2
Timeline
- 2021-01-26: disclosed: NVD publication date
- 2021-01-20: patched: Version 1.13.2 released with fix
- 2021-01-29: advisory: GitHub Security Advisory published