bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Dangerous SSH commands: critical security hole in GitLab

Summary

In 2017 GitLab contained a critical hole (CVE-2017-12426) through which attackers could execute commands on the server when importing a repository by URL. An option flag injected into the URL caused the rest of the address to be interpreted as a command. Versions 7.9.0 to 9.4.3 were affected; Recurity Labs had previously found similar bugs in Git, Mercurial and other version control systems.

Ideas

  • A URL that starts with a hyphen is read as an option by command line programs.
  • On the server, the bug hits the whole installation, not just a single user.
  • On the server, the Git command sometimes ran with far-reaching privileges.
  • Fixes came for several supported version branches at the same time.

Insights

  • Passing user input on to command line programs is a classic source of injection.
  • Server services that fetch third-party repositories need the same care as clients, if anything more.

Facts

  • The hole was fixed in 9.4.4, 9.3.10, 9.2.19, 9.1.10, 9.0.13 and 8.17.8.
  • The developers rated the hole as critical.

References

Critique

  • The report does not explain whether the import was possible for all users or only for logged-in accounts.

Recommendations

  • Only pass user input to command line programs after a “--” marking the end of options.
  • Keep self-hosted GitLab instances on a supported, current version branch.

Read the original article

Search the Web Archive

hß · 2025

Google Chrome: critical security hole in web browser

In August 2025 Google closed a critical hole in Chrome (CVE-2025-9478), a use-after-free bug in the WebGL backend ANGLE. Attackers could exploit the memory bug via prepared websites, which usually leads to the execution of malicious code. The hole was fixed in Chrome 139.0.7258.154/155; Chromium-based browsers such as Edge are likely to be affected as well.

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.

hß · 2016

NSA hacking tools: critical security hole in FortiGate firewalls, patch now

In August 2016 Fortinet closed a critical hole in FortiOS up to version 4.x through which an attacker could gain admin rights remotely with a manipulated HTTP request. Shortly before, the group Shadow Brokers had published tools of the Equation Group, including exploits for FortiGate firewalls. Fortinet did not name the leak as the reason, but a connection seemed likely.