Improper Handling of Alternate Data Stream Affecting nodegit package, versions <0.26.3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NODEGIT-542721
- published 7 Jan 2020
- disclosed 10 Dec 2019
- credit Unknown
Introduced: 10 Dec 2019
CVE-2019-1352 Open this link in a new tabHow to fix?
Upgrade nodegit to version 0.26.3 or higher.
Overview
nodegit is a Node bindings to the libgit2 project.
Affected versions of this package are vulnerable to Improper Handling of Alternate Data Stream. Git was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone.
While the description contains "NTFS", this vulnerability can not only be exploited on Windows, but also on macOS when working on smb://-mounted network shares. The exploit involves naming a directory .git::$INDEX_ALLOCATION, allowing remote code execution during a regular git clone.
The fix for this CVE requires the fix for CVE-2019-1353.