GHSA-hxwm-x553-x359 Arbitrary Command Injection due to Improper Command Sanitization
Attackers can execute arbitrary shell commands via unsanitized Git arguments in the npmcli/git library, requiring user interaction to trigger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-hxwm-x553-x359?
GHSA-hxwm-x553-x359 is a command injection vulnerability in @npmcli/git, published on 5 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Summary
There exists a command injection vulnerability in npmcli/git versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input.
The impact of this issue is possible Arbitrary Command Injection when npmcli/git is run with untrusted (user controlled) Git command arguments.
Impact
Arbitrary Command Injection
Details
npmcli/git prior to release 2.0.8 passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing git+https://github.com/npm/git; echo hello world would trigger the shell execution of echo hello world.
This issue was remediated by no longer running npmcli/git git commands through an intermediate shell.
Patches
This issue has been patched in release 2.0.8
Acknowledgements
This report was reported to us by @tyage (Ierae Security) through the GitHub Bug Bounty Program.
Which versions are affected by GHSA-hxwm-x553-x359?
2 open source packages ship an affected version, including @npmcli/git.
| Package | Affected | Fixed in |
|---|---|---|
@npmcli/git npm | All versions | 2.0.8 |
@npmcli/git npm | All versions | 2.0.8 |
How do I fix GHSA-hxwm-x553-x359?
Upgrade @npmcli/git to 2.0.8 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-hxwm-x553-x359 being exploited?
There is no known exploitation of GHSA-hxwm-x553-x359 in the wild and no public exploit code.