Executive brief
ungit is a web-based Git client that allows users to manage Git repositories through a browser interface. A command injection vulnerability in the URL parameter allows attackers to execute arbitrary system commands on the server, potentially compromising the entire development environment and any code repositories managed through the application.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the URL parameter handling of ungit versions prior to 0.9.0. The application fails to properly sanitize user-supplied input in the URL parameter, allowing attackers to inject arbitrary shell commands that will be executed with the privileges of the ungit process. The attack is network-accessible and requires no authentication, making it trivial to exploit. An attacker can achieve complete remote code execution on the server. The fix is available in version 0.9.0 and later.
Affected products
- ungit ungit prior to 0.9.0
Timeline
- 2015-01-04: disclosed
- 2015: patched: Fixed in version 0.9.0
- 2020-08-31: advisory: GitHub Security Advisory GHSA-vjfr-p6hp-jqqw published