Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-28955

CVE-2021-28955:
Arbitrary code execution due to an uncontrolled search path for the git binary

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-28955
GHSA ID
GHSA-m898-h4pm-pqfr
EPSS Score
0.65398%
CWE
CWE-427
Published
5/25/2021
Updated
10/2/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/MichaelMure/git-buggo< 0.7.20.7.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure PATH search when executing git binaries. The patch replaces os/exec.Command with execabs.Command to prevent current directory precedence. The modified runGitCommandWithIO function was the execution point for git commands, making it the vulnerable entry point prior to patching. The function signature matches Go's method naming convention (package.(*Struct).Method) and would appear in stack traces when executing external commands.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *o l*n*u*** r***ntly ***r*ss** * s**urity issu* in t** w*y t**t *in*ri*s *r* *oun* ***or* **in* *x**ut**. Som* op*r*tin* syst*ms lik* Win*ows p*rsist to **v* t** *urr*nt *ir**tory **in* p*rt o* t** ****ult s**r** p*t*, *n* **vin* prio

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* `P*T*` s**r** w**n *x**utin* *it *in*ri*s. T** p*t** r*pl***s `os/*x**.*omm*n*` wit* `*x****s.*omm*n*` to pr*v*nt *urr*nt *ir**tory pr*****n**. T** mo*i*i** `run*it*omm*n*Wit*IO` *un*tion w*s t** *x**ution point