PT-2021-24153 · Gitit · Gitit

Dwisiswant0 · Published 2021-12-06 · Updated 2021-12-08 · CVE-2021-44685

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Git-it versions through 4.4.0

Description: The issue allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name, which is not sanitized for execution.

Recommendations: For versions through 4.4.0, as a temporary workaround, consider disabling the execution of the reflog command with unsanitized branch names until a patch is available. Restrict access to the Branches Aren't Just For Birds challenge step to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-44685

GHSA-WJQC-J537-J9GJ

Affected Products

Gitit

References · 9

• 🔥 https://github.com/dwisiswant0/advisory/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44685 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjqc-j537-j9gj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44685 · Security Note
• https://github.com/jlord/git-it-electron/releases · Note
• https://github.com/jlord/git-it-electron · Note
• https://t.me/cibsecurity/33425 · Telegram Post
• https://t.me/cvenotify/24310 · Telegram Post
• https://advisory.dw1.io/3 · Note