* CVE Request: cgit directory traversal
@ 2013-05-25 18:16 Jason
[not found] ` <2064382145.8213708.1369657855832.JavaMail.root@redhat.com>
0 siblings, 1 reply; 3+ messages in thread
From: Jason @ 2013-05-25 18:16 UTC (permalink / raw)
Hi Kurt,
As mentioned in early messages to oss-sec, I've inherited
maintainership of the cgit codebase and am gradually auditing it.
Today I found a nasty directory traversal:
http://somehost/?url=/somerepo/about/../../../../etc/passwd
This should be pretty straightforward to categorize.
Exploitation looks like:
http://data.zx2c4.com/cgit-directory-traversal.png
I've committed a fix for it here:
http://git.zx2c4.com/cgit/commit/?h=wip&id=babf94e04e74123eb658a823213c062663cdadd6
And this fix will be in the master branch and a new release will be made soon.
Cgit by default is not vulnerable to this, and the vulnerability only
exists when a user has configured cgit to use a readme file from a
filesystem filepath instead of from the git repo itself. Until a
release is made, administrators are urged to disable reading the
readme file from a filepath, if currently enabled.
Thanks,
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-05-27 21:44 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-05-25 18:16 CVE Request: cgit directory traversal Jason
[not found] ` <2064382145.8213708.1369657855832.JavaMail.root@redhat.com>
[not found] ` <51A39F77.7020907@redhat.com>
2013-05-27 20:36 ` [oss-security] " Jason
2013-05-27 21:44 ` Jason
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).