Skip to content
This repository has been archived by the owner on Dec 19, 2023. It is now read-only.

Fix Arbitary Code Execution #1

Merged
merged 1 commit into from
Sep 10, 2020
Merged

Fix Arbitary Code Execution #1

merged 1 commit into from
Sep 10, 2020

Conversation

alromh87
Copy link

@alromh87 alromh87 commented Sep 8, 2020

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-npm-mrgit

⚙️ Description *

mrgit was vulnerable against arbitrary command injection cause some user supplied inputs were taken and executed with shelljs function without prior validation.
After update Arbitary Code Execution is avoided

💻 Technical Description *

Comands are executed using shelljs without sanitization, leading to Arbitrary Code Execution, missing sanitization was added

🐛 Proof of Concept (PoC) *

Install the package and run the below code:

const diff = require( './lib/commands/diff' );
diff.execute({arguments:['test; touch HACKED; #'], toolOptions:{packages:'', }, repository:{directory:''}})

It will create a file HACKED in the working directory.

Captura de pantalla de 2020-09-08 18-32-33

🔥 Proof of Fix (PoF) *

After fix no file is created

Captura de pantalla de 2020-09-08 18-56-34

👍 User Acceptance Testing (UAT)

Commands can be executed normally

@JamieSlome JamieSlome merged commit a0fbb08 into 418sec:master Sep 10, 2020
@huntr-helper
Copy link
Member

Congratulations alromh87 - your fix has been selected! 🎉

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section. Your bounty is on its way - keep hunting!

# for free to subscribe to this conversation on GitHub. Already have an account? #.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants