Git vulnerabilities allow arbitrary code execution (CVE-2018-17456) Reproduction

Git vulnerability allows arbitrary code execution (CVE-2018-17456)

Foreign security researcher joernchen reported details about the vulnerability to the GIT official team on June 13, September 23. On October 5, the GIT project disclosed a vulnerability numbered CVE-2018-17456. When a user clones a malicious repository, this vulnerability may cause arbitrary code execution.

Vulnerability description

This vulnerability has been assigned a unique ID for the CVE-2018-17456, similar to the previous CVE-2017-1000117 selectable injection vulnerability-a malicious repository can create a new. gitmodules file that contains a URL starting with a break.

When git uses the -- recurse-submodules parameter to clone a repository, this command translates the URL into an option and then uses this option for remote code execution on the computer.

When you run "Git clone -- recurse-submodules", git parses the url field in the. gitmodules file and passes it as a parameter to the "Git clone" subprocess. If the URL field is a string and starts with a short line, the "Git clone" sub-process translates the URL into an option. This may cause the user to execute any script in the superproject when running "Git clone.

Affected Product GitHub Desktop

GitHub desktop 1.4.1 and earlier versions contain embedded git affected by this vulnerability.

Atom

Atom contains the same embedded git and is also affected. Versions 1.31.2 and 1.32.0-beta3 include patches.

Git command line

Git on the command line and other clients

Vulnerability recurrence

Git command line for Mac OS, version 2.10.1

• 0x1 first create a repository on GitHub and then upload a repository. GitmodulesFile, which is written into payload:

 
[Submodule "test"] Path = test url = SSH: //-oproxycommand = touch jimz-test/[email protected]:/timwr/test. Git
 

IfTouch jimz-test.

Since then, our malicious repository has been created.

• 0x2 open the affected git on the target and enter Payload

 
Git clone https://github.com/zhengjim/CVE-2018-17456.git -- recurse-submodules
 

ThenLs CVE-2018-17456View

The jimz-test file exists, proving that it has been executedTouch jimz-test

Recurrence successful

Solution

This vulnerability has been found in git v2.19.1 (with backports in v2.14.5, v2.15.3, v2.16.5, v2.17.2, and v2.18.1), GitHub desktop 1.4.2, GitHub desktop 1.4.3-beta0, atom 1.31.2 and atom 1.32.0-beta3 are fixed.

• Update the GIT command line tool to the latest version officially released by git.

• GitHub desktop is updated to version 1.4.2 and 1.4.3-beta0.

• Atom is updated to version 1.31.2 and 1.32.0-beta3.

References

• Https://mp.weixin.qq.com/s/8ccCxij6XI90sfJzvpkDVg
• Https://zhuanlan.kanxue.com/article-5210.htm
• Http://hackernews.cc/archives/24216

Git vulnerabilities allow arbitrary code execution (CVE-2018-17456) Reproduction