Security Fix for Remote Code Execution - huntr.dev

[huntr-helper]

https://huntr.dev/app/users/Asjidkalam has fixed the Remote Code Execution vulnerability 🔨. Asjidkalam has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
GitHub Issue URL | #3
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/node-tagged-git-commits/1/README.md

User Comments:

📊 Metadata *

Remote Code Execution Vulnerability

Bounty URL: https://www.huntr.dev/app/bounties/open/1-npm-node-tagged-git-commits

⚙️ Description *

Fixed the code execution by escaping the shell argument using the shell-escape library.

💻 Technical Description *

shell-escape is used to escape and stringify an array of arguments to be executed on the shell. There were multiple instances on the index.js in which the user-supplied input is concatenated into command strings, unsanitized, which is then passed to execa.shellSync() which triggers the code execution. This is mitigated using the shell-escape library.

🐛 Proof of Concept (PoC) *

Create a project with a vulnerable package and run the following snippet and listen to requests on localhost.

const taggedCommits = require('tagged-git-commits');

taggedCommits({
    path: './git || curl "http://localhost/RCE"',
});

🔥 Proof of Fix (PoF) *

After applying the fix, the escape-shell module properly sanitizes the user-supplied information before passing into the execa.shellSync(). and the curl command is no more executed. Hence code execution is mitigated.

:)