Executive brief
The git-hub command-line tool, used for managing GitHub repositories, contains a security flaw that fails to properly check data received from the GitHub API. An attacker who controls a repository or can intercept network traffic could provide a malicious repository URL that executes unauthorized commands on the user's computer. This could lead to a full system compromise or theft of sensitive data when a user attempts to clone a repository.
Technical details
The git-hub tool fails to sanitize the repository URL and name returned by the GitHub API before passing them as arguments to the 'git clone' command. This lack of validation allows for command injection and option injection. Specifically, an attacker can craft a repository URL using the 'ext::' protocol or inject git configuration options (e.g., --config=core.gitProxy) to execute arbitrary shell commands. The vulnerability is exploitable by a malicious GitHub server operator or via a Man-in-the-Middle (MitM) attack, particularly on older Python versions (pre-2.7.9) that do not verify SSL certificates by default. The issue is fixed in version 0.10.3.
Affected products
- sociomantic-tsunami git-hub before 0.10.3
Timeline
- 2016-09-06: disclosed: Issue reported on GitHub repository
- 2016-09-30: other: CVE assigned via OSS-security mailing list
- 2017-01-19: advisory: NVD publication date