Executive brief
Git-it is an educational tool for learning Git version control. The application fails to sanitize user input when verifying branch names during a training challenge, allowing attackers to inject arbitrary system commands that execute with the privileges of the user running the application. This could lead to unauthorized access, data theft, or system compromise.
Technical details
The vulnerability is a classic OS command injection (CWE-78) flaw in the branch verification logic. Specifically, the "Branches Aren't Just For Birds" challenge step concatenates an unsanitized branch name directly into a git reflog command without proper escaping or input validation. An attacker can craft a malicious branch name containing shell metacharacters (e.g., semicolons, pipes, backticks) to execute arbitrary commands. The attack requires local access and user interaction (setting up a malicious repository and triggering the verification step), but results in arbitrary command execution with the application's privileges. Git-it versions through 4.3.0 are affected.
Affected products
- jlord git-it-electron through 4.3.0
Timeline
- 2021-08-05: disclosed: Vulnerability disclosed on GitHub
- 2021-12-08: advisory: GHSA-wjqc-j537-j9gj published
- 2021-12-07: other: CVE-2021-44685 assigned