PT-2014-5942 · Gitlist · Gitlist

Drone · Publicado 2014-07-22 · Atualizado 2018-08-13 · CVE-2014-4511

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gitlist versions prior to 0.5.0

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a blame, file, or stats page. This can be demonstrated by requests to endpoints such as "blame/master/", "master/", and "stats/master/".

Recommendations For Gitlist versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the blame, file, and stats pages until the update is applied. Avoid using shell metacharacters in file names in the URI of requests to these pages.

Exploit

Correção

Identificadores relacionados

CVE-2014-4511

Produtos afetados

Gitlist

Referências · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/gitlist_exec.rb · Exploit
• 🔥 http://exploit-db.com/exploits/33990 · Exploit
• 🔥 http://exploit-db.com/exploits/33929 · Exploit
• 🔥 https://exploit-db.com/exploits/33990 · Exploit
• 🔥 https://exploit-db.com/exploits/33929 · Exploit
• 🔥 http://packetstormsecurity.com/files/127364/Gitlist-Unauthenticated-Remote-Command-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/127281/Gitlist-0.4.0-Remote-Code-Execution.html · Exploit
• 🔥 http://hatriot.github.io/blog/2014/06/29/gitlist-rce · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4511 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4511 · Nota de Segurança
• https://groups.google.com/forum/#%21topic/gitlist/Hw_KdZfA4js · Nota