CVE-2024-21532 ggit is vulnerable to Command Injection via the fetchTags(branch) API
Attackers can execute arbitrary commands via the fetchTags API in the ggit library due to unsafe string concatenation in git commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21532?
CVE-2024-21532 is a high-severity command injection vulnerability in ggit, published on 8 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.
Weakness: CWE-78
Which versions are affected by CVE-2024-21532?
2 open source packages ship an affected version, including ggit.
| Package | Affected | Fixed in |
|---|---|---|
ggit npm | All versions to 2.4.12 | None |
ggit npm | All versions to 2.4.12 | None |
How do I fix CVE-2024-21532?
No fix has been published for CVE-2024-21532 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-21532 being exploited?
There is no known exploitation of CVE-2024-21532 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-62cx-5xj4-wfm4.