CVE-2017-1000451 fs-git command injection vulnerability
Attackers can execute arbitrary commands via unsanitized input in fs-git library methods that use child_process.exec.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000451?
CVE-2017-1000451 is a high-severity command injection vulnerability in n/a, published on 2 Jan 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across all methods that use it and call exec.
Which versions are affected by CVE-2017-1000451?
2 open source packages ship an affected version, including fs-git. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fs-git npm | All versions | 1.0.2 |
fs-git npm | All versions | 1.0.2 |
Products include Fs-Git Project Fs-Git.
How do I fix CVE-2017-1000451?
Upgrade fs-git to 1.0.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-1000451 being exploited?
There is no known exploitation of CVE-2017-1000451 in the wild and no public exploit code.
Sources
Also known as GHSA-wp3j-gv53-4pg8.