CVE-2021-44685

Vulnerability

CVE-2021-44685 describes an OS command injection vulnerability in Git-it through version 4.4.0, specifically in the "Branches Aren't Just For Birds" challenge step [1]. During the verification process for this challenge, the application attempts to run the reflog command followed by the current branch name. The branch name is not sanitized before being passed to the command execution, allowing an attacker to inject arbitrary OS commands [1][2].

Exploitation

An attacker must be able to create or control a Git branch name containing shell metacharacters. The attack is triggered when a user opens the affected challenge step and the application automatically runs the reflog verification process with the unsanitized branch name [1][2]. No authentication is required beyond the ability to contribute to the repository; a user could simply clone the repository, create a malicious branch, and push it to a shared remote, expecting other Git-it users to fetch and attempt the challenge [2].

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands with the privileges of the Git-it application process. This could lead to full compromise of the user's system, including data exfiltration, installation of malware, or privilege escalation [1][2]. The impact is rated high due to the ease of exploitation and potential for complete system takeover.

Mitigation

As of the available references, no official patch or fixed version has been released for Git-it [4]. Users should consider discontinuing use of Git-it, especially for the affected challenge step, and monitor the project's release page for updates [3][4]. No workaround is documented; the safest approach is to avoid the vulnerable functionality until a fix is provided.