Executive brief
reg-keygen-git-hash-plugin is an npm package used for generating git hash keys in visual regression testing workflows. Versions before 0.10.16 contain a command injection flaw that allows remote attackers to execute arbitrary system commands on machines running vulnerable versions. This could lead to complete compromise of build systems, data theft, or deployment of malware in CI/CD pipelines.
Technical details
The vulnerability is classified as OS command injection (CWE-78, CWE-94) caused by improper neutralization of special elements used in shell commands. The vulnerable component constructs OS commands using externally-influenced input without proper escaping or sanitization, allowing attackers to inject and execute arbitrary commands. The vulnerability requires adjacent network access and has no privilege or user interaction requirements. An attacker can achieve high confidentiality impact, low integrity impact, and low availability impact with scope change. The fix implemented in version 0.10.16 involves proper shell string escaping to neutralize command injection vectors.
Affected products
- reg-viz reg-keygen-git-hash-plugin <0.10.16
Timeline
- 2021-06-08: disclosed: Advisory published
- 2021-06-08: patched: Fix released in version 0.10.16