Executive brief
git-interface is a Node.js library that provides programmatic access to Git operations. A command injection flaw allows attackers to execute arbitrary operating system commands by manipulating the git remote URL or destination directory parameters when cloning repositories, potentially leading to full system compromise.
Technical details
The vulnerability exists in git-interface's handling of the git clone command when both the git remote URL and destination directory are user-supplied. The library improperly constructs the git clone invocation, failing to sanitize the --upload-pack argument, which allows attackers to inject arbitrary shell commands. No authentication or user interaction is required; an attacker can exploit this remotely by providing malicious input to any application using the vulnerable library. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the process running git-interface. The vulnerability was patched in version 2.1.2.
Affected products
- yarkeev git-interface prior to 2.1.2
Timeline
- 2022-04-23: disclosed
- 2022-04-26: patched: Fixed in version 2.1.2