PT-2014-5942 · Gitlist · Gitlist

Drone · Published 2014-07-22 · Updated 2018-08-13 · CVE-2014-4511

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gitlist versions prior to 0.5.0

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a blame, file, or stats page. This can be demonstrated by requests to endpoints such as "blame/master/", "master/", and "stats/master/".

Recommendations For Gitlist versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the blame, file, and stats pages until the update is applied. Avoid using shell metacharacters in file names in the URI of requests to these pages.

Exploit

Fix

Related Identifiers

CVE-2014-4511

Affected Products

Gitlist

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/gitlist_exec.rb · Exploit
• 🔥 http://exploit-db.com/exploits/33990 · Exploit
• 🔥 http://exploit-db.com/exploits/33929 · Exploit
• 🔥 https://exploit-db.com/exploits/33990 · Exploit
• 🔥 https://exploit-db.com/exploits/33929 · Exploit
• 🔥 http://packetstormsecurity.com/files/127364/Gitlist-Unauthenticated-Remote-Command-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/127281/Gitlist-0.4.0-Remote-Code-Execution.html · Exploit
• 🔥 http://hatriot.github.io/blog/2014/06/29/gitlist-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4511 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4511 · Note
• https://groups.google.com/forum/#%21topic/gitlist/Hw_KdZfA4js · Note