4 ms·

It appears to set the pager setting for the repo to `cowsay "pwned"`, which appears to be able to be duplicated via setting an environment variable `GIT_PAGER="

• TeMPOraL 3y ago
  If it can set it to `cowsay ...`, it can presumably also set it to anything else. Like, a subshell that looks for and uploads interesting data (e.g. .env files) to some pastebin and then pops you the paged output you're expecting?
  • upon_drumhead 3y ago
    Sure, but you are already logged into the machine and writing arbitrary commands, it’s game over. You could write a cron or put something into bashrc. Does that mean cron or bash is exploited?
    • TeMPOraL 3y ago
      Excluding curl ... | sh, neither bash nor cron tend to run random code from the Internet on their own. A git repo, on the other hand, is almost always some random code you got from the Internet. You also don't expect using git itself to inspect a random repo to execute arbitrary code from that repo.
      • upon_drumhead 3y ago
        This example given in the link also does not execute arbitrary code from just cloning the repo, nor does any other repos you directly clone. You would be required to run commands to setup the exploit. There is an issue around embedded bare repos in archives, however, that is not the given exploit in the linked repo at all.