PT-2018-5218 · Fs Git · Fs-Git

Publicado 2018-01-02 · Atualizado 2022-05-13 · CVE-2017-1000451

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fs-git version 1.0.1

Description The issue concerns a command injection problem. The buildCommand method in the fs-git module does not properly sanitize data, making it vulnerable to command injection across all methods that use it and call child process.exec.

Recommendations For fs-git version 1.0.1, consider disabling the buildCommand method until a patch is available to prevent command injection attacks. Restrict access to the child process.exec function to minimize the risk of exploitation. Avoid using the buildCommand method in the affected API endpoints until the issue is resolved.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-1000451

GHSA-WP3J-GV53-4PG8

Produtos afetados

Fs-Git

Referências · 5

• https://github.com/vvakame/fs-git/commit/eb5f70efa5cfbff1ab299fa7daaa5de549243998 · Nota
• https://nodesecurity.io/advisories/360 · Correção
• https://osv.dev/vulnerability/CVE-2017-1000451 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wp3j-gv53-4pg8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000451 · Nota de Segurança