PT-2018-5218 · Fs Git · Fs-Git

Published 2018-01-02 · Updated 2022-05-13 · CVE-2017-1000451

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fs-git version 1.0.1

Description The issue concerns a command injection problem. The buildCommand method in the fs-git module does not properly sanitize data, making it vulnerable to command injection across all methods that use it and call child process.exec.

Recommendations For fs-git version 1.0.1, consider disabling the buildCommand method until a patch is available to prevent command injection attacks. Restrict access to the child process.exec function to minimize the risk of exploitation. Avoid using the buildCommand method in the affected API endpoints until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-1000451

GHSA-WP3J-GV53-4PG8

Affected Products

Fs-Git

References · 5

• https://nodesecurity.io/advisories/360 · Patch
• https://osv.dev/vulnerability/CVE-2017-1000451 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wp3j-gv53-4pg8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000451 · Security Note
• https://github.com/vvakame/fs-git/commit/eb5f70efa5cfbff1ab299fa7daaa5de549243998 · Note