CVE-2021-23632: Git Package RCE Vulnerability

CVE-2021-23632 Overview

CVE-2021-23632 is a Remote Code Execution (RCE) vulnerability affecting all versions of the git package for Node.js. The vulnerability exists due to missing input sanitization in the Git.git method, which allows attackers to execute arbitrary operating system commands rather than only intended git commands. This command injection flaw enables unauthenticated attackers to remotely execute malicious code on systems running applications that use the vulnerable package.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary system commands on affected servers, potentially leading to complete system compromise, data exfiltration, or lateral movement within an organization's infrastructure.

Affected Products

• git_project git (all versions for Node.js)
• Applications using the git npm package
• Node.js environments with the vulnerable git package installed

Discovery Timeline

• 2022-03-17 - CVE-2021-23632 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23632

Vulnerability Analysis

This vulnerability is classified as CWE-78 (OS Command Injection), a severe class of security flaws that occurs when an application constructs operating system commands using externally-influenced input without proper neutralization. In this case, the git npm package fails to sanitize user-supplied input before passing it to the underlying shell for execution.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. An attacker can leverage this flaw to execute arbitrary commands with the same privileges as the Node.js application process, which could include access to sensitive files, system configurations, and network resources.

Root Cause

The root cause of CVE-2021-23632 lies in the Git.git method's failure to properly sanitize or validate input parameters before constructing and executing shell commands. The method directly passes user-controlled input to the system shell, allowing attackers to inject additional commands using shell metacharacters such as semicolons (;), pipes (|), or command substitution operators.

When user input containing shell metacharacters is passed to the Git.git method, the shell interprets these characters as command separators, enabling the execution of arbitrary commands beyond the intended git operation.

Attack Vector

The attack vector for this vulnerability is network-based, meaning an attacker can exploit it remotely without requiring local access to the target system. The attack does not require user interaction or any special privileges.

To exploit this vulnerability, an attacker supplies malicious input containing shell metacharacters to an application endpoint that passes user data to the vulnerable Git.git method. For example, input like version; date would cause the application to execute both git version and the date command. An attacker could replace the benign date command with malicious payloads such as reverse shells, data exfiltration commands, or system reconnaissance operations.

The proof of concept demonstrates that even without a valid git repository being present, the command injection can be successfully triggered, making exploitation straightforward for attackers who identify applications using this vulnerable package.

Detection Methods for CVE-2021-23632

Indicators of Compromise

• Unusual process spawning from Node.js applications, particularly commands unrelated to git operations
• Unexpected network connections initiated by Node.js processes
• Suspicious shell commands in application logs containing semicolons, pipes, or backticks
• Evidence of command chaining patterns in input parameters (e.g., ; command, | command, $(command))

Detection Strategies

• Implement dependency scanning in CI/CD pipelines to identify applications using the vulnerable git npm package
• Monitor application logs for input patterns containing shell metacharacters being passed to git-related functions
• Deploy runtime application self-protection (RASP) solutions to detect and block command injection attempts
• Use static application security testing (SAST) tools to identify code paths where user input reaches the Git.git method

Monitoring Recommendations

• Enable comprehensive logging for all Node.js applications using the git package
• Set up alerts for anomalous process execution patterns from Node.js application contexts
• Monitor for unexpected child processes spawned by Node.js that do not match expected git operations
• Review application access logs for suspicious input patterns containing shell metacharacters

How to Mitigate CVE-2021-23632

Immediate Actions Required

• Audit all applications and dependencies to identify usage of the vulnerable git npm package
• Implement strict input validation to reject any input containing shell metacharacters before passing to git operations
• Consider replacing the git npm package with alternative libraries that properly sanitize inputs, such as simple-git or isomorphic-git
• Deploy web application firewalls (WAF) with rules to detect and block command injection patterns

Patch Information

As of the available information, no official patch has been released for the git npm package to address this vulnerability. Organizations using this package should consider migrating to alternative git libraries for Node.js that implement proper input sanitization. For additional details, refer to the Snyk Vulnerability Report.

Workarounds

• Implement a wrapper function that sanitizes all input before calling the Git.git method, stripping or escaping shell metacharacters
• Use an allowlist approach to validate that input contains only expected characters (alphanumeric, hyphens, underscores)
• Run Node.js applications in sandboxed environments with minimal system privileges to limit the impact of successful exploitation
• Deploy network segmentation to isolate systems running vulnerable applications from critical infrastructure

# Example input validation in application code
# Reject inputs containing shell metacharacters before passing to git operations
# Characters to block: ; | & $ ` ( ) { } [ ] < > \ " '
# Implement allowlist validation for git branch names, commit hashes, etc.