PT-2022-16694 · Unknown · Simple-Git

Alessio Della Libera · Published 2022-03-11 · Updated 2023-08-08 · CVE-2022-24433

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 3.3.0

Description The issue allows for Command Injection via argument injection. When calling the fetch function with parameters remote, branch, and handlerFn, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it is possible to achieve arbitrary command execution.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the input for the remote and branch parameters in the fetch function to prevent arbitrary command execution.

Fix

Argument Injection

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-88

CWE-77

CWE-74

Related Identifiers

CVE-2022-24433

GHSA-3F95-R44V-8MRG

SNYK-JAVA-ORGWEBJARSNPM-2421245

SNYK-JS-SIMPLEGIT-2421199

Affected Products

Simple-Git

References · 11

• https://github.com/steveukx/git-js/pull/767 · Patch
• https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0 · Patch
• https://osv.dev/vulnerability/CVE-2022-24433 · Vendor Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2421245 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24433 · Security Note
• https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199 · Patch
• https://osv.dev/vulnerability/GHSA-3f95-r44v-8mrg · Vendor Advisory
• https://github.com/steveukx/git-js · Note
• https://t.me/cvenotify/28127 · Telegram Post
• https://t.me/cibsecurity/38818 · Telegram Post
• https://t.me/cibsecurity/40023 · Telegram Post