CVE-2022-24433
📋 TL;DR
CVE-2022-24433 is a command injection vulnerability in the simple-git npm package that allows attackers to execute arbitrary commands on the host system by injecting malicious git options into the .fetch() function parameters. This affects any application using vulnerable versions of simple-git to interact with git repositories, particularly Node.js applications that accept user-controlled input for git operations.
💻 Affected Systems
- simple-git npm package
📦 What is this software?
Simple Git by Simple Git Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Arbitrary command execution in the context of the application user, potentially leading to data theft, system modification, or service disruption.
If Mitigated
Limited impact if input validation and proper sandboxing prevent malicious parameter injection.
🎯 Exploit Status
Exploitation requires the application to accept user input for the remote or branch parameters in .fetch() calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.0 and later
Vendor Advisory: https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0
Restart Required: Yes
Instructions:
1. Update package.json to specify 'simple-git': '^3.3.0' 2. Run 'npm update simple-git' or 'yarn upgrade simple-git' 3. Restart the application
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize all user input before passing to simple-git methods
Sandbox Execution
allRun the application in a container or restricted user account with minimal privileges
🧯 If You Can't Patch
- Implement strict input validation to prevent injection of git options
- Run the application with minimal privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list simple-git' to see installed versionCheck Version:
npm list simple-git | grep simple-gitVerify Fix Applied:
Confirm version is 3.3.0 or higher with 'npm list simple-git'📡 Detection & Monitoring
Log Indicators:
- Unusual git fetch commands with unexpected options
- Process execution from Node.js application with suspicious arguments
Network Indicators:
- Unexpected outbound connections from the application host
SIEM Query:
process.name:node AND cmdline:*git* AND cmdline:*fetch* AND (cmdline:*--upload-pack* OR cmdline:*--exec*)🔗 References
- https://github.com/steveukx/git-js/pull/767
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2421245
- https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199
- https://github.com/steveukx/git-js/pull/767
- https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2421245
- https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199
