CVE-2022-25860: Insufficient Information (NVD-CWE-noinfo)
value: Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-01-26T21:15Z
Repository: https://github.com/steveukx/git-js
Language: TypeScript
Files changed: .changeset/fair-cobras-arrive.md, docs/PLUGIN-UNSAFE-ACTIONS.md, simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts, simple-git/test/unit/plugin.unsafe.spec.ts
Commit date: 2022-12-22 17:25:32 +0000
Commit message: Block unsafe pack (push --exec) (#882)

Add `git push --exec` to the set of blocked operations without the use of an `allowUnsafePack` override.

Diff: diff --git a/.changeset/fair-cobras-arrive.md b/.changeset/fair-cobras-arrive.md
new file mode 100644
index 0000000..cac1da1
--- /dev/null
+++ b/.changeset/fair-cobras-arrive.md
@@ -0,0 +1,5 @@
+---
+'simple-git': patch
+---
+
+Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @stsewd for the suggestion.
diff --git a/docs/PLUGIN-UNSAFE-ACTIONS.md b/docs/PLUGIN-UNSAFE-ACTIONS.md
index 3075638..a6cdd36 100644
--- a/docs/PLUGIN-UNSAFE-ACTIONS.md
+++ b/docs/PLUGIN-UNSAFE-ACTIONS.md
@@ -4,10 +4,31 @@ As `simple-git` passes generated arguments through to a child process of the cal
 that any parameter sourced from user input is validated before being passed to the `simple-git` api.
 
 In some cases where there is an elevated potential for harm `simple-git` will throw an exception unless you have
 explicitly opted in to the potentially unsafe action.
 
+### Enabling custom upload and receive packs
+
+Instead of using the default `git-receive-pack` and `git-upload-pack` binaries to parse incoming and outgoing
+data, `git` can be configured to use _any_ arbitrary binary or evaluable script.
+
+To avoid accidentally triggering the evaluation of a malicious script when merging user provided parameters
+into command executed by `simple-git`, custom pack options (usually with the `--receive-pack` and `--upload-pack`)
+are blocked without explicitly opting into their use  
+
+```typescript
+import { simpleGit } from 'simple-git';
+
+// throws
+await simpleGit()
+   .raw('push', '--receive-pack=git-receive-pack-custom');
+
+// allows calling clone with a helper transport
+await simpleGit({ unsafe: { allowUnsafePack: true } })
+   .raw('push', '--receive-pack=git-receive-pack-custom');
+```
+
 ### Overriding allowed protocols
 
 A standard installation of `git` permits `file`, `http` and `ssh` protocols for a remote. A range of 
 [git remote helpers](https://git-scm.com/docs/gitremote-helpers) other than these default few can be
 used by referring to te helper name in the remote protocol - for example the git file descriptor transport
diff --git a/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts b/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts
index 109c1c6..c476259 100644
--- a/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts
+++ b/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts
@@ -37,10 +37,18 @@ function preventUploadPack(arg: string, method: string) {
          undefined,
          'unsafe',
          `Use of clone with option -u is not permitted without enabling allowUnsafePack`
       );
    }
+
+   if (method === 'push' && /^\s*--exec\b/.test(arg)) {
+      throw new GitPluginError(
+         undefined,
+         'unsafe',
+         `Use of push with option --exec is not permitted without enabling allowUnsafePack`
+      );
+   }
 }
 
 export function blockUnsafeOperationsPlugin({
    allowUnsafeProtocolOverride = false,
    allowUnsafePack = false,
diff --git a/simple-git/test/unit/plugin.unsafe.spec.ts b/simple-git/test/unit/plugin.unsafe.spec.ts
index f23fc4e..18b265c 100644
--- a/simple-git/test/unit/plugin.unsafe.spec.ts
+++ b/simple-git/test/unit/plugin.unsafe.spec.ts
@@ -6,13 +6,14 @@ import {
    newSimpleGit,
 } from './__fixtures__';
 
 describe('blockUnsafeOperationsPlugin', () => {
    it.each([
+      ['clone', '-u touch /tmp/pwn'],
       ['cmd', '--upload-pack=touch /tmp/pwn0'],
       ['cmd', '--receive-pack=touch /tmp/pwn1'],
-      ['clone', '-u touch /tmp/pwn'],
+      ['push', '--exec=touch /tmp/pwn2'],
    ])('allows %s %s only when using override', async (cmd, option) => {
       assertGitError(
          await promiseError(newSimpleGit({ unsafe: {} }).raw(cmd, option)),
          'allowUnsafePack'
       );

Vulnerable code:       ['clone', '-u touch /tmp/pwn'],
Fixed code: ---
'simple-git': patch
---

Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @stsewd for the suggestion.
### Enabling custom upload and receive packs

Instead of using the default `git-receive-pack` and `git-upload-pack` binaries to parse incoming and outgoing
data, `git` can be configured to use _any_ arbitrary binary or evaluable script.

To avoid accidentally triggering the evaluation of a malicious script when merging user provided parameters
into command executed by `simple-git`, custom pack options (usually with the `--receive-pack` and `--upload-pack`)
are blocked without explicitly opting into their use  

```typescript
import { simpleGit } from 'simple-git';

// throws
await simpleGit()
   .raw('push', '--receive-pack=git-receive-pack-custom');

// allows calling clone with a helper transport
await simpleGit({ unsafe: { allowUnsafePack: true } })
   .raw('push', '--receive-pack=git-receive-pack-custom');
```


   if (method === 'push' && /^\s*--exec\b/.test(arg)) {
      throw new GitPluginError(
         undefined,
         'unsafe',
         `Use of push with option --exec is not permitted without enabling allowUnsafePack`
      );
   }
      ['clone', '-u touch /tmp/pwn'],
      ['push', '--exec=touch /tmp/pwn2'],