Listen to this Post
How the CVE Works:
Soft Serve, a self-hostable Git server, fails to sanitize ANSI escape sequences in user-controlled input fields such as repository names and commit messages. When this unsanitized input is rendered in a terminal client, the embedded escape sequences are interpreted and executed. This allows an attacker to inject codes that manipulate the terminal display, for instance, by moving the cursor, altering colors, or overwriting existing text to create fake system alerts or obfuscate log output. The vulnerability stems from the application’s trust in user-supplied data before echoing it back to users connected via SSH or viewing logs, effectively turning the terminal into a vector for social engineering and output confusion attacks.
Platform: Soft Serve Git Server
Version: <= 0.10.0
Vulnerability: ANSI Injection
Severity: Moderate
date: 2025-11-06
Prediction: Patch 2025-11-13
What Undercode Say:
echo -e "\e[41;1;37m DANGER: FAKE ALERT \e[0m" git commit -m $'Real message\e[2K\r\e[1;31mHACKED' ssh user@soft-serve-server
How Exploit:
Inject ANSI sequences in repo names or commit messages. The sequences execute when listed, faking alerts or hiding commands.
Protection from this CVE
Upgrade to Soft Serve v0.11.0. Sanitize all user input by stripping ANSI escape sequences before terminal output.
Impact:
Terminal output manipulation, social engineering via fake alerts, and obfuscation of activity in logs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
