PT-2020-8914 · Pullit · Pullit

Published 2020-09-03 · Updated 2025-02-24 · CVE-2018-25083

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pullit versions prior to 1.4.0

Description The issue allows OS Command Injection because eval() is used on an attacker-supplied Git branch name. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.

Recommendations Upgrade to version 1.4.0 or later. As a temporary workaround, consider disabling the use of eval() on attacker-supplied Git branch names until a patch is available. Restrict access to the exec call with unvalidated git branch names to minimize the risk of exploitation.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2018-25083

GHSA-2W9P-XF5H-QWJ3

GHSA-8PX5-63X9-5C7P

Affected Products

Pullit

References · 12

• 🔥 https://security.snyk.io/vuln/npm:pullit:20180214 · Exploit
• https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb · Patch
• https://osv.dev/vulnerability/CVE-2018-25083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25083 · Security Note
• https://osv.dev/vulnerability/GHSA-2w9p-xf5h-qwj3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8px5-63x9-5c7p · Vendor Advisory
• https://github.com/jkup/pullit · Note
• https://github.com/jkup/pullit/issues/23 · Note
• https://hackerone.com/reports/315773 · Note
• https://t.me/cvenotify/112352 · Telegram Post
• https://t.me/cvenotify/46930 · Telegram Post
• https://t.me/cvenotify/47199 · Telegram Post