Executive brief
workspace-tools is a JavaScript utility for managing monorepo workspaces. The library contains a command injection vulnerability in its git fetch functionality that allows attackers to inject arbitrary git flags and execute commands on systems using the affected versions. An attacker who can control the remote or branch name parameters could achieve remote code execution on any system using the vulnerable library.
Technical details
The vulnerability is a command injection flaw (CWE-77/CWE-78) in the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function. The remote and remoteBranch parameters are concatenated directly into a git fetch command without proper escaping or validation, allowing an attacker to inject flags like --upload-pack to execute arbitrary code. The attack requires only that an application call fetchRemoteBranch() with untrusted input (e.g., from user-controlled repository URLs or branch names); no authentication is required. An attacker can leverage git's --upload-pack flag to execute shell commands with the privileges of the process running the vulnerable code. The fix, released in version 0.18.4, adds a "--" separator to the git command to prevent further argument injection, as documented in pull request #103.
Affected products
- Microsoft workspace-tools before 0.18.4
Timeline
- 2022-03-11: disclosed
- 2022-05-14: advisory
- 2022-04-20: patched: Fix released in version 0.18.4