Executive brief
git-tags-remote is a Node.js package that retrieves Git tags from remote repositories. The package fails to sanitize user-supplied repository URLs before executing them as shell commands, allowing an attacker to inject arbitrary commands. An attacker with control over the repository parameter could execute arbitrary code on the system running the application.
Technical details
The vulnerability is a command injection (CWE-78) in the `get()` function caused by unsanitized input passed directly to an `exec` call. The package concatenates user-controlled repository parameters into a shell command without validation or escaping. An attacker can terminate the intended command with a semicolon and append arbitrary shell commands. The attack requires the repository parameter to be user-controlled; if the repository value comes directly from an application's trusted input, exposure is limited. The vulnerability was fixed in version 1.0.4 by replacing `exec` with the safer `spawn` function, which avoids shell interpretation of input.
Affected products
- git-tags-remote git-tags-remote all versions before 1.0.4
Timeline
- 2020-07-29: disclosed: Vulnerability published on GitHub Advisory Database
- 2020-07-29: patched: Fixed in version 1.0.4 by using spawn instead of exec