CVE-2019-10776
📋 TL;DR
This vulnerability allows remote command injection in git-diff-apply npm package. An attacker can execute arbitrary commands on the system by controlling the remoteUrl parameter. All users of git-diff-apply versions prior to 0.22.2 are affected.
💻 Affected Systems
- git-diff-apply
📦 What is this software?
Git Diff Apply by Git Diff Apply Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary command execution as the user running the application, potentially leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Remote code execution allowing attackers to run commands, access sensitive data, or pivot to other systems in the network.
If Mitigated
No impact if proper input validation and sanitization are implemented, or if the vulnerable version is not used.
🎯 Exploit Status
Exploitation is straightforward - attackers can inject shell commands through the remoteUrl parameter. Multiple security advisories and proof-of-concepts are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.22.2
Vendor Advisory: https://github.com/kellyselden/git-diff-apply/commit/106d61d3ae723b4257c2a13e67b95eb40a27e0b5
Restart Required: No
Instructions:
1. Update package.json to require git-diff-apply version 0.22.2 or higher. 2. Run 'npm update git-diff-apply'. 3. Verify the update with 'npm list git-diff-apply'.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict validation of remoteUrl parameter to prevent command injection
// JavaScript example: Validate URL format before passing to git-diff-apply
const urlRegex = /^[a-zA-Z0-9.:\/\-_]+$/;
if (!urlRegex.test(remoteUrl)) { throw new Error('Invalid URL format'); }
Environment Restriction
linuxRun the application with minimal privileges and in isolated environments
# Run as non-root user
sudo -u appuser node app.js
# Use container isolation
docker run --read-only --cap-drop=ALL node:alpine
🧯 If You Can't Patch
- Implement strict input validation on all user-controlled parameters passed to git-diff-apply
- Isolate the application in a container or VM with restricted network access and minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list git-diff-apply' to see if version is below 0.22.2Check Version:
npm list git-diff-apply | grep git-diff-applyVerify Fix Applied:
Confirm git-diff-apply version is 0.22.2 or higher with 'npm list git-diff-apply'📡 Detection & Monitoring
Log Indicators:
- Unusual git commands in application logs
- Suspicious shell commands following git operations
- Failed git operations with malformed URLs
Network Indicators:
- Unexpected outbound connections from the application
- DNS requests for suspicious domains following git operations
SIEM Query:
process.name:"node" AND cmdline:"git-diff-apply" AND (cmdline:*"|"* OR cmdline:*";"* OR cmdline:*"&"*)🔗 References
- https://github.com/kellyselden/git-diff-apply/commit/106d61d3ae723b4257c2a13e67b95eb40a27e0b5
- https://snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774%2C
- https://snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774
- https://github.com/kellyselden/git-diff-apply/commit/106d61d3ae723b4257c2a13e67b95eb40a27e0b5
- https://snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774%2C
