Fix CVE–2022–25912

[debricked]

CVE–2022–25912

Vulnerability details

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

NVD

The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

GitHub

simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

GitLab Advisory Database (Open Source Edition)

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    NVD - CVE-2022-25912
    simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol · CVE-2022-25912 · GitHub Advisory Database · GitHub
    npm/simple-git/CVE-2022-25912.yml · main · GitLab.org / GitLab Advisory Database Open Source Edition · GitLab
    Release simple-git@3.15.0 · steveukx/git-js · GitHub
    Remote Code Execution (RCE) in org.webjars.npm:simple-git | CVE-2022-25912 | Snyk
    Remote Code Execution (RCE) in simple-git | CVE-2022-25912 | Snyk
    THIRD PARTY
    Chore: bump lerna, jest and create prettier workflow (#862) · steveukx/git-js@7746480 · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE