CVE-2018-3785: Command Injection in git-dummy-commit
Summary
CVE-2018-3785: Command Injection in git-dummy-commit. Affects git-dummy-commit versions < 1.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-dummy-commit is an npm package that allows users to create dummy commits in a Git repository. It is commonly used for testing and demonstration purposes. The vulnerability in version 1.3.0 of git-dummy-commit allows for command injection due to an unescaped parameter. This means that an attacker can execute arbitrary operating system commands by manipulating the parameter. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
Vulnerability Detail
The command injection vulnerability in git-dummy-commit arises from the lack of proper parameter sanitization. When a user provides input that includes malicious commands, these commands are not properly escaped or validated, allowing them to be executed by the underlying operating system. This can lead to various security risks, including unauthorized access, data manipulation, and remote code execution. The vulnerability affects all versions of git-dummy-commit up to and including 1.3.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually sanitize the input before passing it to git-dummy-commit. This involves validating and escaping any user-provided input to ensure that it does not contain any malicious commands. Here is an example of how to sanitize the input in JavaScript:
const sanitizedInput = userProvidedInput.replace(/[^a-zA-Z0-9]/g, '');
Conclusion
The command injection vulnerability in git-dummy-commit can have severe consequences, including unauthorized access and remote code execution. It is crucial to promptly update to a patched version of the package to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-dummy-commit →
FAQ
git-dummy-commit is an npm package used for creating dummy commits in Git repositories. It is often used for testing and demonstration purposes.
Command injection is a security vulnerability that allows an attacker to execute arbitrary operating system commands by manipulating input parameters. In the case of git-dummy-commit, the lack of proper parameter sanitization allows for command injection.
The command injection vulnerability in git-dummy-commit can lead to unauthorized access, data manipulation, and remote code execution. An attacker could exploit this vulnerability to gain control over the affected system and perform malicious actions.
To fix the vulnerability, it is recommended to upgrade to a patched version of git-dummy-commit. Updating to version 1.3.1 or later will resolve the command injection vulnerability.
Yes, as a workaround, users can manually sanitize the input before passing it to git-dummy-commit. This involves validating and escaping any user-provided input to ensure that it does not contain any malicious commands.
