CVE-2019-10803
📋 TL;DR
CVE-2019-10803 is a command injection vulnerability in push-dir npm package that allows attackers to execute arbitrary commands on systems using vulnerable versions. The vulnerability occurs because user-controlled input in the 'opt.branch' parameter is not properly sanitized before being passed to git commands. This affects any application or system using push-dir version 0.4.1 or earlier.
💻 Affected Systems
- push-dir
📦 What is this software?
Push Dir by Push Dir Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Unauthorized code execution in the context of the application user, potentially leading to data theft, system modification, or service disruption.
If Mitigated
Limited impact if proper input validation and command sanitization are implemented, restricting execution to intended git operations only.
🎯 Exploit Status
Exploitation is straightforward - attackers can inject shell commands through the branch parameter. Public proof-of-concept exists showing command injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.2 and later
Vendor Advisory: https://github.com/L33T-KR3W/push-dir/security/advisories
Restart Required: No
Instructions:
1. Update push-dir package using npm: 'npm update push-dir' 2. Verify version is 0.4.2 or higher: 'npm list push-dir' 3. Test functionality to ensure compatibility.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for branch names before passing to push-dir
// JavaScript example: validate branch names
const branchName = sanitizeInput(userInput);
if (!/^[a-zA-Z0-9\-\_\/]+$/.test(branchName)) {
throw new Error('Invalid branch name');
}
Use Alternative Git Methods
allReplace push-dir with direct git commands or other validated libraries
// Instead of push-dir, use:
git add . && git commit -m 'message' && git push origin branch-name
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-controlled parameters passed to push-dir
- Run push-dir in isolated containers or sandboxes with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list push-dir | grep push-dirCheck Version:
npm list push-dir | grep 'push-dir@'Verify Fix Applied:
Verify version is 0.4.2 or higher: npm list push-dir | grep 'push-dir@'📡 Detection & Monitoring
Log Indicators:
- Unusual git commands with shell metacharacters
- Unexpected command execution in application logs
- Failed git operations with suspicious branch names
Network Indicators:
- Unexpected outbound connections from CI/CD systems
- Unusual git protocol traffic patterns
SIEM Query:
process.name:node AND cmdline:*push-dir* AND (cmdline:*;* OR cmdline:*&* OR cmdline:*|* OR cmdline:*`*)