Executive brief
The pullit package, a Node.js utility used to display and download branches from GitHub pull requests, is vulnerable to command injection. An attacker can create a malicious branch name on GitHub that, when selected by a user of the tool, executes arbitrary commands on the user's computer. This could lead to full system compromise, data theft, or the installation of malware.
Technical details
The pullit package before version 1.4.0 for Node.js contains an OS command injection vulnerability. The root cause is the insecure use of the JavaScript eval() function (and subsequently exec() calls) on Git branch names retrieved from GitHub pull requests. An attacker can exploit this by creating a pull request with a specially crafted branch name containing shell metacharacters (e.g., using semicolons or backticks). When a user runs the pullit CLI tool and selects the malicious branch to check out, the injected commands are executed with the privileges of the user running the tool. This is a remote attack vector requiring minimal user interaction (selecting the branch). The issue is fixed in version 1.4.0.
Affected products
- jkup pullit < 1.4.0
Timeline
- 2017-10-24: disclosed: Initial disclosure to maintainer
- 2018-02-14: advisory: Vulnerability published by Snyk
- 2018-02-19: patched: Fix committed to repository
- 2023-03-27: advisory: GHSA and NVD records published