Command Injection Affecting check-branches package, versions *

check-branches is a CLI to automatically check if your current repo branch has any conflicts with all other repo's branches. Really useful when working with big teams.

Affected versions of this package are vulnerable to Command Injection. check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.

However, the library follows these conventions which can be abused:

1. It trusts branch names as they are (plain text)
2. It spawns git commands by concatenating user input

Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.

1. Install check-branches@0.0.19, which is the latest.

npm install -g check-branches

2. Make sure there's a valid git repository with remotes configured and at least one valid branch created

3. Create a new git branch as follows: git checkout -b ";{echo,hello,world}>/tmp/d" (these characters are indeed valid in git branch names)

4. Run the check-branches program in the git project directory check-branches, and observe output similar to:

❯ check-branches
********************************
* check-branches CLI v0.0.19 *
********************************

✔ generating report
Wow! Congratulations! Your current branch has no conflicts with any other liran-test-repo repo branches!
time for 'check': 151ms

5. Confirm that the file /tmp/d was created with the contents of hello world in it.

• GitHub Gist