PT-2022-16447 · Unknown · Simple-Git

Liran Tal · Published 2022-04-01 · Updated 2025-04-22 · CVE-2022-24066

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 3.5.0

Description The issue arises from an incomplete fix of a previous command injection vulnerability, which only addressed the git fetch attack vector. The --upload-pack feature of git, also supported for git clone, was not covered by the prior fix, leaving it vulnerable to command injection.

Recommendations For versions prior to 3.5.0, update to simple-git@3.5.0 to resolve the issue. As a temporary workaround, consider restricting the use of the --upload-pack feature in git clone operations until the update is applied.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2022-24066

GHSA-28XR-MWXG-3QC8

SNYK-JAVA-ORGWEBJARSNPM-2434820

SNYK-JS-SIMPLEGIT-2434306

Affected Products

Simple-Git

References · 14

• 🔥 https://gist.github.com/lirantal/a930d902294b833514e821102316426b · Exploit
• https://github.com/steveukx/git-js/commit/2040de601c894363050fef9f28af367b169a56c5 · Patch
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820 · Patch
• https://osv.dev/vulnerability/GHSA-28xr-mwxg-3qc8 · Vendor Advisory
• https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24066 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24066 · Vendor Advisory
• https://github.com/steveukx/git-js · Note
• https://github.com/steveukx/git-js/releases/tag/simple-git%403.5.0 · Note
• https://t.me/cvenotify/119461 · Telegram Post
• https://t.me/cibsecurity/40023 · Telegram Post
• https://t.me/cibsecurity/54044 · Telegram Post
• https://t.me/cvenotify/39359 · Telegram Post
• https://t.me/cvenotify/39229 · Telegram Post