GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
gitahead:gitahead
References 4
https://github.com/gitahead/gitahead/issues/663
GitHub Issue #663
https://github.com/gitahead/gitahead
NVD
https://github.com/gitahead/gitahead/blob/v2.7.1/src/tools/ShowTool.cpp#L40-L48
NVD
https://www.vulncheck.com/advisories/gitahead-through-2.7.1-on-macos-command-in…
VulnCheck Advisory: GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript