[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20170503131655.GA1397@notk.org>
Date: Wed, 3 May 2017 15:16:55 +0200
From: Adrien Nader <adrien@...k.org>
To: oss-security@...ts.openwall.com
Subject: Re: Sourcetree arbitrary command execution
Hi,
On Wed, May 03, 2017, redrain root wrote:
> Hi there,
>
> I would report a sourcetree arbitrary command execution
>
> Sourcetree is a popular git gui client,and I found a command execution two
> month ago,
> and I report to the official atlassian but the told me they have known this
> vulnerability internal tracker and they will fix it in next version but
> sourcetree has upgrade several version, this vulnerability still alive.
> So I want to disclose this vulnerability and make a copy for atlassian
> again.
Unless I'm mistaken, the source for it isn't available.
I see you've Cc'ed fulldisclosure@...lists.org and
security@...assian.com too and it sounds more applicable to them.
> SourceTree v2.5c and prior are affected by a command injection in the
> handling of sourcetree:// scheme.
> The cloneRepo action with ‘ext’ is base on git-remote-ext, The git team’s
> description of the bug was:
> Some protocols (like git-remote-ext) can execute arbitrary code found in
> the URL.
You make it sound like there might be something related to
"git-remote-ext" or its (typicala) usage but you're not giving details
except that it's difficult to tell if it happens in othe software too
and the following seems to indicate it is very specific to Sourcetree:
> PoC:
> sourcetree://cloneRepo/ext::[command injection]
> Even attacker can exploit it through the browser
Best regards,
--
Adrien Nader
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
