Security Advisory: Executor Command Injection

1. Executive Summary

A vulnerability has been identified within the GitRoot executors system. Under specific conditions, it is possible for a malicious actor to execute unauthorized commands on the host machine. Given the complexity of the required conditions, this vulnerability is not easily exploitable in a standard production environment.

• Severity: Moderate
• Affected Version: 0.3.0
• Fix Status: Scheduled for version 0.4.0

2. Technical Details

The vulnerability stems from the way executors validate commands defined by plugins. Currently, a plugin can declare a benign command in its manifest (e.g., cat), but execute an arbitrary command during runtime (e.g., rm -rf data/). GitRoot currently lacks a strict enforcement mechanism to verify that the executed binary matches the declared command.

3. Impact Analysis

The level of risk depends on your infrastructure configuration:

• High Risk: Users utilizing bareMetal or ssh executors.
• Low Risk: Users utilizing bubblewrap or container isolation (as the sandbox significantly limits the potential impact on the host).

Exploitability Constraints: This vulnerability is not a “remote code execution” flaw in the traditional sense. Exploitation requires:

1. Installing a malicious plugin.
2. Having write access to the default branch of the root repository.
3. Merging a malicious .gitroot/plugins.yml into the default branch.

Currently, creating plugins is undocumented, and the only known plugin using executors is hop. Since any modification to .gitroot/plugins.yml requires a merge into the default branch, a standard code review process should easily detect and prevent such malicious entries.

4. Immediate Mitigations

If you cannot wait for the 0.4.0 release, we recommend applying the following measures:

• Disable Executors: Set your forge configuration for executors to None.
• Secure Executors: Use more secure executors, such as bwrap or container.
• Plugin Trust: Only install and enable plugins from trusted sources.
• Access Control: Strictly monitor and review all changes to .gitroot/plugins.yml, specifically focusing on authorized system commands.

5. Patch Schedule

This vulnerability will be fully addressed in version 0.4.0. We have decided not to release an intermediate 0.3.1 patch, as the attack vector relies on an “insider” or “compromised account” scenario that is effectively mitigated by standard code review practices.

6. Security Contact

Transparency and security are core values at GitRoot. If you discover any other potential vulnerabilities or have questions regarding this report, please contact us directly at contact@gitroot.dev.