Executive brief
simple-git is a popular Node.js library used by developers to automate Git commands within their applications. A security flaw allows an attacker to execute unauthorized commands on the server by providing specially crafted input to the 'fetch' function. This could lead to a full system takeover, unauthorized data access, or disruption of services.
Technical details
The simple-git library before version 3.3.0 is vulnerable to command injection through argument injection. The root cause is the improper sanitization of the 'remote' and 'branch' parameters within the .fetch(remote, branch, handlerFn) function, which are passed directly to the underlying 'git fetch' subcommand. An attacker can supply git options such as '--upload-pack' as part of these parameters to break out of the intended command and execute arbitrary shell commands. This vulnerability can be exploited remotely if the application passes user-controlled input to the fetch function without validation. The issue is resolved in version 3.3.0.
Affected products
- steveukx simple-git < 3.3.0
Timeline
- 2022-03-11: disclosed
- 2022-03-11: patched: Fixed in version 3.3.0
- 2022-03-12: advisory