PT-2022-16654 · Unknown · Git-Promise

Liran Tal · Published 2022-06-10 · Updated 2023-08-08 · CVE-2022-24376

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions git-promise versions all

Description The issue is related to Command Injection due to an inappropriate fix of a prior vulnerability in the git-promise package. The README file was updated with a warning regarding this issue. It is noted that the vulnerability will not be fixed.

Recommendations As a permanent solution is not available, consider avoiding the use of the git-promise package until alternative solutions are found. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-77

Related Identifiers

CVE-2022-24376

GHSA-CHJ3-F7XW-367M

Affected Products

Git-Promise

References · 7

• 🔥 https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-GITPROMISE-2434310 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24376 · Security Note
• https://osv.dev/vulnerability/GHSA-chj3-f7xw-367m · Vendor Advisory
• https://github.com/piuccio/git-promise · Note
• https://t.me/cibsecurity/44224 · Telegram Post
• https://github.com/lirantal/git-promise/commit/030e4f993f3b65419d60f7f60e81e0a742b72e77 · Note