Command Injection Affecting gfc package, versions *
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-GFC-1023302
- published 28 Oct 2020
- disclosed 27 Oct 2020
- credit d3lla
How to fix?
There is no fixed version for gfc.
Overview
gfc is a Simple way to initialize a new git repository in an empty directory, add a file and do a first commit (or skip that part in a directory with files). Useful for unit tests and generators.
Affected versions of this package are vulnerable to Command Injection via the options argument which is used to build the command that is passed to the child_process.exec function without any sanitization.
POC
const firstCommit = require('gfc');
const options = {message: '""; touch HACKED;'};
firstCommit('.', options, function(err) {});
References
CVSS Scores
version 3.1