CVE Request: cgit directory traversal

CVE Request: cgit directory traversal

[Jason]

Hi Kurt,

As mentioned in early messages to oss-sec, I've inherited
maintainership of the cgit codebase and am gradually auditing it.
Today I found a nasty directory traversal:

http://somehost/?url=/somerepo/about/../../../../etc/passwd

This should be pretty straightforward to categorize.

Exploitation looks like:
http://data.zx2c4.com/cgit-directory-traversal.png

I've committed a fix for it here:
http://git.zx2c4.com/cgit/commit/?h=wip&id=babf94e04e74123eb658a823213c062663cdadd6

And this fix will be in the master branch and a new release will be made soon.

Cgit by default is not vulnerable to this, and the vulnerability only
exists when a user has configured cgit to use a readme file from a
filesystem filepath instead of from the git repo itself. Until a
release is made, administrators are urged to disable reading the
readme file from a filepath, if currently enabled.

Thanks,
Jason

[oss-security] CVE Request: cgit directory traversal

[Jason]

Hi Kurt,

This issue has now been fixed with CGit v0.9.2:

The announcement may be read here:
http://lists.zx2c4.com/pipermail/cgit/2013-May/001394.html

Jason

[oss-security] CVE Request: cgit directory traversal

[Jason]

On Mon, May 27, 2013 at 2:30 PM, Jan Lieskovsky <jlieskov at redhat.com> wrote:
> Can you provide a patch that would apply against v0.9.1 version too? Or
> would this be just problem of master branch code?

I could, but you'd be much better off just upgrading to v0.9.2.