Executive brief
The git-hub command-line tool, used for managing GitHub repositories, is vulnerable to a remote code execution flaw. By providing a specially crafted repository name through the GitHub API, an attacker can trick the tool into executing malicious commands on the user's computer. This could lead to a full system compromise, data theft, or unauthorized access to the user's development environment.
Technical details
The git-hub tool fails to sanitize repository names and URLs retrieved from the GitHub API before passing them as arguments to 'git clone' commands. An attacker controlling a GitHub instance (or performing a Man-in-the-Middle attack on older Python versions) can provide a repository name containing shell metacharacters or git configuration flags (e.g., --config=core.gitProxy). This leads to argument injection and arbitrary code execution when the tool attempts to clone the malicious repository. The vulnerability is addressed in version 0.10.3 by implementing proper input validation and sanitization for data received from the GitHub API.
Affected products
- sociomantic-tsunami git-hub before 0.10.3
Timeline
- 2016-09-06: disclosed: Issue reported on GitHub repository
- 2016-09-30: advisory: Mailing list disclosure on oss-security
- 2017-01-19: advisory: NVD publication date