CVE-2019-5485

Vulnerability

Overview

The NPM package gitlabhook version 0.0.17 is a Node.js module designed to handle GitLab webhooks. It contains a command injection vulnerability in the handling of the repository name field. The package fails to properly sanitize user-supplied input before passing it to shell execution functions, allowing an attacker to inject arbitrary operating system commands [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the webhook endpoint with a malicious repository name containing shell metacharacters (e.g., backticks, semicolons, or pipes). No authentication is required if the endpoint is exposed to the internet. The injected commands are executed with the privileges of the Node.js process, typically leading to remote code execution [1].

Impact

Successful exploitation grants the attacker full remote code execution on the server hosting the gitlabhook instance. This can lead to data exfiltration, lateral movement within the network, and complete compromise of the affected system [2].

Mitigation

As of the CVE publication date, no official patch has been released for gitlabhook 0.0.17. The package appears to be unmaintained. Users are advised to avoid using this package, implement strict input validation and sanitization for the repository name field, or migrate to an alternative solution [2].