PT-2022-13891 · Git+1 · Git+1

Published 2022-04-22 · Updated 2022-05-04 · CVE-2022-1440

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions git-interface versions 2.1.1 through 2.1.1

Description A command injection issue exists in the git-interface. If both the git remote and destination directory are provided by user input, the use of a --upload-pack command-line argument feature of git is also supported for git clone, allowing any operating system command to be spawned by the attacker.

Recommendations For git-interface version 2.1.1, update to version 2.1.2 to resolve the issue. As a temporary workaround, consider restricting the use of the --upload-pack command-line argument feature of git for git clone until a patch is available.

Exploit

Fix

Argument Injection

OS Command Injection

Weakness Enumeration

CWE-88

CWE-78

Related Identifiers

CVE-2022-1440

GHSA-QFFW-8WG7-H665

Affected Products

Git

Git-Interface

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1440.json · Exploit
• 🔥 https://huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1 · Exploit
• https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d · Patch
• https://osv.dev/vulnerability/CVE-2022-1440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1440 · Security Note
• https://osv.dev/vulnerability/GHSA-qffw-8wg7-h665 · Vendor Advisory
• https://github.com/yarkeev/git-interface · Note
• https://t.me/cibsecurity/41342 · Telegram Post