CVE-2022-25860 (published 2023-01-26T21:15Z)

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.\rThis vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).\r\r

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/steveukx/git-js
commit_details: repo_url: https://github.com/steveukx/git-js
author: Steve King
author_date: 2022-12-22 17:25:32+00:00
msg: Block unsafe pack (push --exec) (#882)

Add `git push --exec` to the set of blocked operations without the use of an `allowUnsafePack` override.
repository: repo_url: https://github.com/steveukx/git-js
repo_name: steveukx/git-js
description: A light weight interface for running git commands in any node.js application.
repo_language: TypeScript
owner: steveukx
file_changes: filename: fair-cobras-arrive.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,5 @@
+---
+'simple-git': patch
+---
+
+Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @stsewd for the suggestion.

programming_language: Markdown
filename: PLUGIN-UNSAFE-ACTIONS.md
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,27 @@ that any parameter sourced from user input is validated before being passed to t
 In some cases where there is an elevated potential for harm `simple-git` will throw an exception unless you have
 explicitly opted in to the potentially unsafe action.
 
+### Enabling custom upload and receive packs
+
+Instead of using the default `git-receive-pack` and `git-upload-pack` binaries to parse incoming and outgoing
+data, `git` can be configured to use _any_ arbitrary binary or evaluable script.
+
+To avoid accidentally triggering the evaluation of a malicious script when merging user provided parameters
+into command executed by `simple-git`, custom pack options (usually with the `--receive-pack` and `--upload-pack`)
+are blocked without explicitly opting into their use  
+
+```typescript
+import { simpleGit } from 'simple-git';
+
+// throws
+await simpleGit()
+   .raw('push', '--receive-pack=git-receive-pack-custom');
+
+// allows calling clone with a helper transport
+await simpleGit({ unsafe: { allowUnsafePack: true } })
+   .raw('push', '--receive-pack=git-receive-pack-custom');
+```
+
 ### Overriding allowed protocols
 
 A standard installation of `git` permits `file`, `http` and `ssh` protocols for a remote. A range of 

programming_language: Markdown
filename: block-unsafe-operations-plugin.ts
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,14 @@ function preventUploadPack(arg: string, method: string) {
          `Use of clone with option -u is not permitted without enabling allowUnsafePack`
       );
    }
+
+   if (method === 'push' && /^\s*--exec\b/.test(arg)) {
+      throw new GitPluginError(
+         undefined,
+         'unsafe',
+         `Use of push with option --exec is not permitted without enabling allowUnsafePack`
+      );
+   }
 }
 
 export function blockUnsafeOperationsPlugin({

programming_language: TypeScript
filename: plugin.unsafe.spec.ts
change_type: ModificationType.MODIFY
diff: @@ -8,9 +8,10 @@ import {
 
 describe('blockUnsafeOperationsPlugin', () => {
    it.each([
+      ['clone', '-u touch /tmp/pwn'],
       ['cmd', '--upload-pack=touch /tmp/pwn0'],
       ['cmd', '--receive-pack=touch /tmp/pwn1'],
-      ['clone', '-u touch /tmp/pwn'],
+      ['push', '--exec=touch /tmp/pwn2'],
    ])('allows %s %s only when using override', async (cmd, option) => {
       assertGitError(
          await promiseError(newSimpleGit({ unsafe: {} }).raw(cmd, option)),

programming_language: TypeScript