CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists...
- Published
- Oct 4, 2017
- Updated
- Aug 5, 2024
- Assigning CNA
- mitre
- Evidence observed
- Aug 31, 2017
Primary CVSS
nvd · CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.6%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
Sources
modules/exploits/multi/http/git_submodule_command_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Unix($.exploit_multi/http/git_submodule_command_exec.platform)
- verification: check_not_declared($.exploit_multi/http/git_submodule_command_exec.check)
- CVE-2017-1000117Exploit
CVE-2017-1000117漏洞复现（PoC+Exp）
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.