Fix Arbitary Code Execution

[alromh87]

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-npm-git-static

⚙️ Description *

git-static was vulnerable against arbitrary command injection because some user supplied inputs were taken and formatted inside the exec() function without prior validation.
After update Arbitary Code Execution is avoided by using execFile instead of exec

💻 Technical Description *

Arbitary Code Execution is avoided by using execFile() instead of exec() and passing arguments via parameters instead of composing strings, piping to grep was replaced with regexp

🐛 Proof of Concept (PoC) *

Install the package and run the below code:

constgitstatic=require("./");gitstatic.getSha('./'," '; whoami>HACKED #",(e,resp)=>{if(e)console.log(e)elseconsole.log(resp)});

It will create a file named HACKED in the working directory.

🔥 Proof of Fix (PoF) *

After fix no file is created

👍 User Acceptance Testing (UAT)

Commands can be executed normally

Correct functionality after fix can be tested with this script:

constgitstatic=require("./");consthandleResp=(e,resp)=>{if(e)console.log(e)elseconsole.log(resp)};gitstatic.getBranches('./',handleResp);gitstatic.getSha('./','master',handleResp);gitstatic.getBranchCommits('./',handleResp);gitstatic.getCommit('./','',handleResp);gitstatic.getCommit('./','ccde678213daa6913d63b30e0f30113e0a6b0c7c',handleResp);gitstatic.getRelatedCommits('./','master','d6c64168559aacd41f8593e53b1e17159560228b',handleResp);gitstatic.getRelatedCommits('./','master','ccde678213daa6913d63b30e0f30113e0a6b0c7c',handleResp);gitstatic.getRelatedCommits('./','master','7101f0f77c9a174c2b0b0916d15dce273a2cab3f',handleResp);gitstatic.listCommits('./','ccde678213daa6913d63b30e0f30113e0a6b0c7c','d6c64168559aacd41f8593e53b1e17159560228b',handleResp);gitstatic.listAllCommits('./',handleResp);gitstatic.listTree('./','ccde678213daa6913d63b30e0f30113e0a6b0c7c',handleResp);

[toufik-airane]

LGTM ☀️

[mufeedvh]

Good fix! 👏🎉

[bbeale]

Solid fix 👍 🎉

[Mik317]

LGTM 😄 🍰

Cheers,
Mik

[huntr-helper]

Congratulations alromh87 - your fix has been selected! 🎉

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section, or hit us up on Discord. Your bounty is on its way - keep hunting!

Come join us on Discord