CVE-2023-25805 (published 2023-02-20T16:15Z)

versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This issue is patched in version 1.1.0.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/commenthol/versionn
commit_details: repo_url: https://github.com/commenthol/versionn
author: commenthol
author_date: 2023-02-19 11:00:55+01:00
msg: fix: Command Injection Vuln
repository: repo_url: https://github.com/commenthol/versionn
repo_name: commenthol/versionn
description: Change version information across multiple files
repo_language: JavaScript
owner: commenthol
file_changes: filename: gitfn.js
change_type: ModificationType.MODIFY
diff: @@ -1,32 +1,44 @@
 'use strict'
 
-var child = require('child_process')
-
-function GitFn (version, options) {
-  this._version = version
-  this._options = {
-    cwd: options.dir,
-    env: process.env,
-    setsid: false,
-    stdio: [0, 1, 2]
+const child = require('child_process')
+const semver = require('semver')
+
+const assertVersionValid = version => {
+  if (!semver.valid(version)) {
+    throw new Error('version is invalid')
   }
 }
-module.exports = GitFn
 
-GitFn.prototype = {
-  tag: function (cb) {
-    var cmd = ['git', 'tag', 'v' + this._version].join(' ')
-    this._exec(cmd, cb)
-  },
-  untag: function (cb) {
-    var cmd = ['git', 'tag', '-d', 'v' + this._version].join(' ')
-    this._exec(cmd, cb)
-  },
-  commit: function (cb) {
-    var cmd = ['git', 'commit', '-am', '"' + this._version + '"'].join(' ')
-    this._exec(cmd, cb)
-  },
-  _exec: function (cmd, cb) {
-    child.exec(cmd, this._options, cb)
+const exec = (cmd, options, cb) => child.exec(cmd, options, cb)
+
+class GitFn {
+  constructor (version, options) {
+    this._version = version
+    this._options = {
+      cwd: options.dir,
+      env: process.env,
+      setsid: false,
+      stdio: [0, 1, 2]
+    }
+  }
+
+  tag (cb) {
+    assertVersionValid(this._version)
+    const cmd = ['git', 'tag', 'v' + this._version].join(' ')
+    exec(cmd, this._options, cb)
+  }
+
+  untag (cb) {
+    assertVersionValid(this._version)
+    const cmd = ['git', 'tag', '-d', 'v' + this._version].join(' ')
+    exec(cmd, this._options, cb)
+  }
+
+  commit (cb) {
+    assertVersionValid(this._version)
+    const cmd = ['git', 'commit', '-am', '"' + this._version + '"'].join(' ')
+    exec(cmd, this._options, cb)
   }
 }
+
+module.exports = GitFn

programming_language: JavaScript
filename: test.js
change_type: ModificationType.MODIFY
diff: @@ -309,4 +309,14 @@ describe('change multiple files', function () {
       done()
     })
   })
+
+  it('shall throw if not a valid version', function (done) {
+    const gitFn = new Version._.GitFn('& touch newFile', { dir: './' })
+    try {
+      gitFn.tag(done)
+    } catch (e) {
+      assert.strictEqual(e.message, 'version is invalid')
+      done()
+    }
+  })
 })

programming_language: JavaScript