Executive brief
ggit is a Node.js library that provides git command wrappers for developers. The fetchTags API accepts user-supplied branch names but fails to properly sanitize this input before passing it to the operating system shell, allowing attackers to inject arbitrary commands. An attacker could execute malicious code on any system running an application that uses ggit with untrusted branch input, potentially leading to data theft, system compromise, or service disruption.
Technical details
The vulnerability exists in the fetchTags(branch) API function, which takes a branch name parameter and directly concatenates it into a git command string without sanitization. This concatenated string is then passed to Node.js's unsafe exec() child process API, which spawns a shell to execute the command. An attacker can bypass the intended git command execution by injecting shell metacharacters (e.g., semicolons, pipes, backticks) to execute arbitrary OS-level commands. The attack requires no authentication and can be triggered by any code that calls fetchTags() with attacker-controlled input (e.g., from API parameters, request bodies, or configuration files). There is no patched version available for ggit; the project appears to be unmaintained.
Affected products
- bahmutov ggit all versions up to 2.4.12
Timeline
- 2023-04-21: disclosed: Vulnerability disclosed via GitHub Gist by Liran Tal
- 2024-10-08: advisory: GHSA-62cx-5xj4-wfm4 published; CVE-2024-21532 assigned