CVE-2018-25083
📋 TL;DR
This vulnerability in the pullit Node.js package allows attackers to execute arbitrary operating system commands by injecting malicious code into Git branch names. It affects any application using vulnerable versions of pullit that processes untrusted branch names. The eval() function on user-supplied input enables complete system compromise.
💻 Affected Systems
- pullit
📦 What is this software?
Pull It by Pull It Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining shell access, installing malware, stealing data, and pivoting to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, or cryptocurrency mining malware installation.
If Mitigated
Limited impact if proper input validation and sandboxing prevent command execution.
🎯 Exploit Status
Simple command injection via branch name parameter; trivial to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.0
Vendor Advisory: https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb
Restart Required: Yes
Instructions:
1. Update package.json to require pullit version 1.4.0 or higher. 2. Run 'npm update pullit' or 'yarn upgrade pullit'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation on branch names before passing to pullit.
// JavaScript example: if (!/^[a-zA-Z0-9\-_\/]+$/.test(branchName)) throw new Error('Invalid branch name');
Remove pullit Dependency
allReplace pullit with alternative Git operations library.
npm uninstall pullit
yarn remove pullit
🧯 If You Can't Patch
- Network segmentation to isolate systems using pullit from critical infrastructure.
- Implement strict egress filtering to prevent command-and-control communication.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list pullit' to see if version is below 1.4.0.Check Version:
npm list pullit | grep pullitVerify Fix Applied:
Confirm pullit version is 1.4.0 or higher with 'npm list pullit' and test with safe branch names.📡 Detection & Monitoring
Log Indicators:
- Unusual child process spawns from Node.js
- Suspicious Git operations with special characters in branch names
Network Indicators:
- Outbound connections from Node.js processes to unexpected destinations
SIEM Query:
process.name:node AND process.args:*eval* AND process.args:*git*