Prototype Pollution in isomorphic-git getRemoteInfo

isomorphic-git versions prior to 1.42.0 are vulnerable to a prototype pollution attack within the getRemoteInfo function. The vulnerability arises when the library parses Git ref advertisements during negotiation. By providing a specially crafted reference name containing 'proto' segments (e.g., 'proto/corsProxy'), a malicious Git server can inject properties into the global Object.prototype.

This injection allows an attacker to redefine global properties used by the library. Specifically, an attacker can redirect network traffic through an arbitrary, attacker-controlled proxy server. When a client application using a vulnerable version of isomorphic-git interacts with the malicious repository, the library may trigger its onAuth callback, causing the leakage of sensitive authentication credentials to the attacker-supplied proxy. This vulnerability presents a high risk for CI/CD environments and developer tools that automate Git interactions with external, potentially untrusted repositories.

Impact

Successful exploitation allows for the interception of authentication credentials used by applications relying on isomorphic-git. This affects any ecosystem or service performing automated Git operations on untrusted remotes, potentially leading to unauthorized access to internal development environments, private repositories, or cloud services.

Recommendation

• Update the isomorphic-git dependency to version 1.42.0 or later across all projects.
• Audit applications for dependencies using isomorphic-git to interact with external or user-provided Git repositories.
• Review CI/CD pipeline configurations to ensure that clones or fetches from untrusted repositories are executed in isolated, ephemeral environments with restricted network access.
• Monitor for abnormal outbound connections originating from build servers or developer machines that execute isomorphic-git operations.