GHSA-gm9x-q798-hmr4 Command Injection in git-tags-remote
Attackers can execute arbitrary system commands by providing malicious repository URLs to the git-tags-remote library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-gm9x-q798-hmr4?
GHSA-gm9x-q798-hmr4 is a command injection vulnerability in git-tags-remote, published on 29 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of git-tags-remote are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an exec call on the get function . This may allow attackers to execute arbitrary code in the system if the repo value passed to the function is user-controlled.
The following proof-of-concept creates a file in /tmp:
const gitTagsRemote = require('git-tags-remote');
gitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo "Injection Success" > /tmp/command-injection.test')
.then(tags => console.log(tags));
Which versions are affected by GHSA-gm9x-q798-hmr4?
2 open source packages ship an affected version, including git-tags-remote.
| Package | Affected | Fixed in |
|---|---|---|
git-tags-remote npm | All versions | 1.0.4 |
git-tags-remote npm | All versions | 1.0.4 |
How do I fix GHSA-gm9x-q798-hmr4?
Upgrade git-tags-remote to 1.0.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-gm9x-q798-hmr4 being exploited?
There is no known exploitation of GHSA-gm9x-q798-hmr4 in the wild and no public exploit code.