CVE-2022-25866: Command injection in czproject/git-php

April 26, 2022 (updated April 27, 2022)

The package czproject/git-php before 4.0.3 is vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

References

github.com/advisories/GHSA-3xpw-vhmv-cw7h
github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733
github.com/czproject/git-php/releases/tag/v4.0.3
nvd.nist.gov/vuln/detail/CVE-2022-25866
snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349

Code Behaviors & Features

Detect and mitigate CVE-2022-25866 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →