CVE-2022-24376 Command Injection
Attackers can execute arbitrary commands via the git-promise library due to an incomplete fix for a previous vulnerability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24376?
CVE-2022-24376 is a high-severity command injection vulnerability in git-promise, published on 10 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue.
Weakness: CWE-88
Which versions are affected by CVE-2022-24376?
2 open source packages ship an affected version, including git-promise. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
git-promise npm | All versions to 1.0.0 | None |
git-promise npm | All versions to 1.0.0 | None |
Products include Git-Promise Project Git-Promise.
How do I fix CVE-2022-24376?
No fix has been published for CVE-2022-24376 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-24376 being exploited?
There is no known exploitation of CVE-2022-24376 in the wild and no public exploit code.
Sources
Also known as GHSA-chj3-f7xw-367m.