CVE-2022-25866 - Vulnerability Details - OpenCVE

ReportizFlow

The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Git-php Project	Git-php

Configuration 1 [-]

cpe:2.3:a:git-php_project:git-php:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733
https://github.com/czproject/git-php/releases/tag/v4.0.3
https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349

History

No history.

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-04-25T17:10:10.912749Z

Updated: 2024-09-16T16:38:31.811Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-25866

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-25T17:15:36.637

Modified: 2024-11-21T06:53:08.347

Link: CVE-2022-25866

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "czproject/git-php", "vendor": "n/a", "versions": [{"lessThan": "4.0.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Alessio Della Libera of Snyk Research Team"}], "datePublic": "2022-04-25T00:00:00", "descriptions": [{"lang": "en", "value": "The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitCodeMaturity": "PROOF_OF_CONCEPT", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 7.7, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Command Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-25T17:10:10", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/czproject/git-php/releases/tag/v4.0.3"}], "title": "Command Injection", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "DATE_PUBLIC": "2022-04-25T17:06:55.902175Z", "ID": "CVE-2022-25866", "STATE": "PUBLIC", "TITLE": "Command Injection"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "czproject/git-php", "version": {"version_data": [{"version_affected": "<", "version_value": "4.0.3"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Alessio Della Libera of Snyk Research Team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349"}, {"name": "https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733", "refsource": "MISC", "url": "https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733"}, {"name": "https://github.com/czproject/git-php/releases/tag/v4.0.3", "refsource": "MISC", "url": "https://github.com/czproject/git-php/releases/tag/v4.0.3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:49:44.449Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/czproject/git-php/releases/tag/v4.0.3"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2022-25866", "datePublished": "2022-04-25T17:10:10.912749Z", "dateReserved": "2022-02-24T00:00:00", "dateUpdated": "2024-09-16T16:38:31.811Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:git-php_project:git-php:*:*:*:*:*:*:*:*", "matchCriteriaId": "F13FD606-BEA5-4F72-ACB0-5F4CB3FE6680", "versionEndExcluding": "4.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection."}, {"lang": "es", "value": "El paquete czproject/git-php versiones anteriores a 4.0.3, es vulnerable a una inyecci\u00f3n de comandos por medio de una inyecci\u00f3n de argumentos git. Cuando es llamado a la funci\u00f3n isRemoteUrlReadable($url, array $refs = NULL), los par\u00e1metros url y refs son pasados al subcomando git ls-remote de forma que puedan establecerse flags adicionales. Los flags adicionales pueden ser usados para llevar a cabo una inyecci\u00f3n de comandos"}], "id": "CVE-2022-25866", "lastModified": "2024-11-21T06:53:08.347", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-04-25T17:15:36.637", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733"}, {"source": "[email protected]", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/czproject/git-php/releases/tag/v4.0.3"}, {"source": "[email protected]", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/czproject/git-php/releases/tag/v4.0.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "[email protected]", "type": "Primary"}]}