4 ms·

GitHub RCE by Environment variable injection Bug Bounty writeup

45 points by helper 13y ago

krallja 13y ago
We prevent this specific attack in Kiln by only allowing specific environment variables to be set.
0x0 13y ago
Will this affect bitbucket as well?
- guipsp 13y ago
  No.
  - 0x0 13y ago
    Why not? Is it specific to github's "gerve" application? What and where is the bug exactly - I mean, how can a username with linefeeds end up setting environment variables? And what username is being set - ssh? github account? wouldn't you need to use exactly the username "git" when ssh'ing in to github to trigger this gerve app anyways?
    - SolarNet 13y ago
      Read closely and you'll see the answers in the link: Yes. "it is possible to inject some environment variables into gerve" Because it's his git hub username. You answered that question yourself: "And what username is being set - ssh? github account? wouldn't you need to use exactly the username 'git' when ssh'ing in to github to trigger this gerve app anyways?" So if it's not his ssh username it must be his... 'github username'! it's the only other possibility you could think of right? ...
mappu 13y ago
I decided to actually read man ld.so and came across this: --ignore-rpath LIST Ignore RPATH and RUNPATH information in object names in LIST. This option has been supported by glibc2 for about one hour. Then it was renamed into: --inhibit-rpath LIST I'm not sure if it's a joke or an incredible testament to backwards compatibility. I've been writing a COFF linker recently, and have been reading lots of comments and man pages about linkers and loaders. The more i read, i think dynamic linking isn't such a good idea after all.
userbinator 13y ago
They must've expected usernames to not contain anything other than alphanumeric characters... this is yet another example of the fact that if you write code that consumes external, untrusted input, always expect every single byte value from 0 to 0xFF could be present, and deal with them accordingly.
jwcrux 13y ago
Any idea what the bounty was for this finding?

45 points by helper 13y ago

krallja 13y ago

We prevent this specific attack in Kiln by only allowing specific environment variables to be set.

0x0 13y ago

Will this affect bitbucket as well?

guipsp 13y ago
No.
- 0x0 13y ago
  Why not? Is it specific to github's "gerve" application? What and where is the bug exactly - I mean, how can a username with linefeeds end up setting environment variables? And what username is being set - ssh? github account? wouldn't you need to use exactly the username "git" when ssh'ing in to github to trigger this gerve app anyways?
  - SolarNet 13y ago
    Read closely and you'll see the answers in the link: Yes. "it is possible to inject some environment variables into gerve" Because it's his git hub username. You answered that question yourself: "And what username is being set - ssh? github account? wouldn't you need to use exactly the username 'git' when ssh'ing in to github to trigger this gerve app anyways?" So if it's not his ssh username it must be his... 'github username'! it's the only other possibility you could think of right? ...

mappu 13y ago

I decided to actually read man ld.so and came across this: --ignore-rpath LIST Ignore RPATH and RUNPATH information in object names in LIST. This option has been supported by glibc2 for about one hour. Then it was renamed into: --inhibit-rpath LIST I'm not sure if it's a joke or an incredible testament to backwards compatibility. I've been writing a COFF linker recently, and have been reading lots of comments and man pages about linkers and loaders. The more i read, i think dynamic linking isn't such a good idea after all.

userbinator 13y ago

They must've expected usernames to not contain anything other than alphanumeric characters... this is yet another example of the fact that if you write code that consumes external, untrusted input, always expect every single byte value from 0 to 0xFF could be present, and deal with them accordingly.

jwcrux 13y ago

Any idea what the bounty was for this finding?