Executive brief
Bazaar, a distributed version control system, is vulnerable to a flaw that allows an attacker to execute malicious commands on a user's system. By tricking a user into accessing a specially crafted repository URL that starts with a dash, an attacker can bypass security restrictions and run arbitrary code. This could lead to a full system compromise, data theft, or unauthorized access to private source code.
Technical details
Bazaar through version 2.7.0 is vulnerable to command injection when using the Subprocess SSH vendor. The root cause is insufficient validation of hostnames in 'bzr+ssh' URLs; specifically, hostnames starting with a dash ('-') are passed directly to the underlying SSH command. An attacker can craft a URL where the 'hostname' is actually a series of SSH command-line options (e.g., using -oProxyCommand). When a victim attempts to interact with such a URL, the SSH client interprets these options as instructions to execute local commands. This is a known class of vulnerability affecting several version control systems (similar to CVE-2017-9800). The issue is mitigated in newer versions by explicitly using the '--' separator for OpenSSH or rejecting dash-prefixed hostnames for other SSH implementations.
Affected products
- Canonical Bazaar <= 2.7.0
Timeline
- 2017-08-15: disclosed: Issue reported on Launchpad bug tracker
- 2017-09-06: patched: Fixed in Debian version 2.7.0+bzr6622-7
- 2017-11-27: advisory: NVD published CVE-2017-14176