CVE-2022-24437
📋 TL;DR
CVE-2022-24437 is a critical command injection vulnerability in git-pull-or-clone npm package that allows attackers to execute arbitrary commands on systems using vulnerable versions. The vulnerability exists in how the package handles the --upload-pack parameter during git clone operations. Any application or service using git-pull-or-clone before version 2.0.2 is affected.
💻 Affected Systems
- git-pull-or-clone npm package
📦 What is this software?
Git Pull Or Clone by Git Pull Or Clone Project
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with the privileges of the process running git-pull-or-clone, potentially leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary command execution allowing attackers to install malware, exfiltrate sensitive data, or pivot to other systems in the network.
If Mitigated
Limited impact if running with minimal privileges, network segmentation, and proper input validation controls are in place.
🎯 Exploit Status
Exploitation requires the ability to control input to git-pull-or-clone functions, which is common in CI/CD pipelines, deployment scripts, or applications that clone user-specified repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2
Vendor Advisory: https://github.com/feross/git-pull-or-clone/commit/f9ce092be13cc32e685dfa26e7705e9c6e3108a3
Restart Required: No
Instructions:
1. Update package.json to require git-pull-or-clone version 2.0.2 or higher. 2. Run npm update git-pull-or-clone. 3. Test your application to ensure compatibility with the updated version.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for repository URLs and parameters passed to git-pull-or-clone functions.
Run with Minimal Privileges
allExecute processes using git-pull-or-clone with the least privileges necessary.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-controlled inputs to git-pull-or-clone functions
- Run affected services in isolated containers or VMs with network restrictions and minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for git-pull-or-clone version. If version is less than 2.0.2, the system is vulnerable.Check Version:
npm list git-pull-or-cloneVerify Fix Applied:
Verify that git-pull-or-clone version is 2.0.2 or higher in package.json and that npm list git-pull-or-clone shows the updated version.📡 Detection & Monitoring
Log Indicators:
- Unusual git clone commands with --upload-pack parameters containing shell metacharacters
- Process execution of unexpected commands following git operations
Network Indicators:
- Outbound connections to unexpected destinations following git clone operations
- Unusual command and control traffic patterns
SIEM Query:
process.name:git AND command_line:*upload-pack* AND command_line:*;* OR command_line:*&* OR command_line:*|*🔗 References
- https://gist.github.com/lirantal/327e9dd32686991b5a1fa6341aac2e7b
- https://github.com/feross/git-pull-or-clone/commit/f9ce092be13cc32e685dfa26e7705e9c6e3108a3
- https://snyk.io/vuln/SNYK-JS-GITPULLORCLONE-2434307
- https://gist.github.com/lirantal/327e9dd32686991b5a1fa6341aac2e7b
- https://github.com/feross/git-pull-or-clone/commit/f9ce092be13cc32e685dfa26e7705e9c6e3108a3
- https://snyk.io/vuln/SNYK-JS-GITPULLORCLONE-2434307
