Executive brief
git-pull-or-clone is a Node.js library used to automate the downloading and updating of Git repositories. A security flaw allows an attacker to execute arbitrary commands on the underlying server if they can influence the repository URL or the destination folder path used by the application. This could lead to a full system takeover, unauthorized data access, or disruption of services.
Technical details
The git-pull-or-clone package before version 2.0.2 is vulnerable to command injection (specifically argument injection). While the library uses the relatively secure child_process.spawn() API, it fails to use the double-dash (--) delimiter to separate git command flags from positional arguments. An attacker providing a malicious string for the 'url' or 'outPath' parameters can inject git options such as '--upload-pack'. This allows for the execution of arbitrary shell commands with the privileges of the Node.js process. The vulnerability is fixed in version 2.0.2 by explicitly adding the '--' delimiter to the git clone argument array.
Affected products
- feross git-pull-or-clone < 2.0.2
Timeline
- 2022-03-28: disclosed: Vulnerability reported to maintainer
- 2022-04-01: patched: Fix committed to repository
- 2022-05-01: advisory: NVD published CVE-2022-24437
- 2022-05-03: advisory: GitHub Advisory published