GitHub Advisoryadvisory · npm

GHSA-3x62-x456-q2vm OS Command Injection in git-pull-or-clone

CRITICAL Published 2022-05-03 Modified 2022-08-22 Official page ↗
Aliases
CVE-2022-24437
Ecosystem
npm
Packages
git-pull-or-clone
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2022-05-23

Affected packages

• npm git-pull-or-clone: < 2.0.2 → fixed in 2.0.2

Description

The package git-pull-or-clone before 2.0.2 is vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection. Credits Credit @lirantal for discovering this vulnerability.

Related

Alias · CVE (1)

  • CVE-2022-24437 The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is… vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References