Skip to content

Commit fe6f338

Browse files
gipigipi
committed
Fix arbitrary execution of code by untrusted user input.
SSH_ORIGINAL_COMMAND was used in an eval() without check: in a normal git push this is not a problem but under the hood this command is only an ssh command so malicious user could do something like the following $ ssh vagrant -C 'bar "foo;rm -vfr /tmp/"' /usr/local/bin/gitreceive: eval: line 45: unexpected EOF while looking for matching `"' /usr/local/bin/gitreceive: eval: line 46: syntax error: unexpected end of file /usr/local/bin/gitreceive: line 54: /home/git//hooks/pre-receive: No such file or directory chmod: cannot access `/home/git//hooks/pre-receive': No such file or directory fatal: unrecognized command 'bar foo' rm: cannot remove `/tmp': Permission denied
1 parent b2fe080 commit fe6f338

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

‎gitreceive‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ EOF
4444
export RECEIVE_USER=$2
4545
export RECEIVE_FINGERPRINT=$3
4646
# ssh provides the original requested command in $SSH_ORIGINAL_COMMAND
47-
eval $(echo $SSH_ORIGINAL_COMMAND | awk '{print "export RECEIVE_REPO="$2}')
47+
export RECEIVE_REPO="$(echo $SSH_ORIGINAL_COMMAND | awk '{print $2}')"
4848
REPO_PATH="$GITHOME/$RECEIVE_REPO"
4949
if [ ! -d $REPO_PATH ]; then
5050
mkdir -p $REPO_PATH
@@ -58,7 +58,7 @@ EOF
5858
cat | $SELF hook
5959
EOF
6060
chmod +x $PRERECEIVE_HOOK
61-
eval "git-shell -c \"$SSH_ORIGINAL_COMMAND\""
61+
git-shell -c "$SSH_ORIGINAL_COMMAND"
6262
;;
6363

6464
hook)

0 commit comments

Comments
 (0)