PT-2022-16696 · Unknown+1 · Git-Pull-Or-Clone+1

Liran Tal · Published 2022-05-01 · Updated 2023-08-08 · CVE-2022-24437

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions git-pull-or-clone versions prior to 2.0.2

Description The issue arises from the use of the --upload-pack feature of git, which is also supported for git clone. Although the source utilizes the secure child process API spawn(), the outpath parameter passed to it may be a command-line argument to the git clone command, resulting in arbitrary command injection.

Recommendations For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the outpath parameter in the git clone command to minimize the risk of exploitation.

Exploit

Fix

Argument Injection

OS Command Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-78

CWE-77

Related Identifiers

CVE-2022-24437

GHSA-3X62-X456-Q2VM

SNYK-JS-GITPULLORCLONE-2434307

Affected Products

Git

Git-Pull-Or-Clone

References · 8

• 🔥 https://gist.github.com/lirantal/327e9dd32686991b5a1fa6341aac2e7b · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-GITPULLORCLONE-2434307 · Exploit
• https://github.com/feross/git-pull-or-clone/commit/f9ce092be13cc32e685dfa26e7705e9c6e3108a3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24437 · Security Note
• https://osv.dev/vulnerability/GHSA-3x62-x456-q2vm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24437 · Vendor Advisory
• https://github.com/feross/git-pull-or-clone · Note
• https://t.me/cvenotify/29523 · Telegram Post