CVE-2017-12976: git-annex Command Injection via Malicious SSH Hostname
Summary
CVE-2017-12976: git-annex command injection via malicious SSH hostname. Affects git-annex versions < 6.20170818. Fixed in 6.20170818. How to fix ↓
Also tracked for
- git-annex · Debian:11
The same CVE-2017-12976 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-annex is an open-source tool that manages files with git, without checking the file contents into git. It allows users to store large files in a distributed way while keeping track of them in git. The tool generates SSH commands based on repository URLs, with the hostname parsed from the URL. However, due to a vulnerability similar to CVE-2017-1000117 in git, git-annex is susceptible to command injection if the parsed hostname contains malicious code. This vulnerability could lead to arbitrary local code execution.
Vulnerability Detail
The vulnerability in git-annex arises from the parsing of repository URLs to generate SSH commands. If the hostname in the URL is crafted to include malicious code (e.g., -eProxyCommand=evil), an attacker can execute arbitrary code on the victim's system. Exploiting this vulnerability requires tricking the victim into adding a remote with a URL like ssh://-eProxyCommand=evil/blah. An alternative attack vector involves embedding the malicious URL in the git-annex branch using initremote and enabling it with enableremote. The issue was addressed in version 6.20170818 of git-annex by introducing a SshHost type that disallows hostnames starting with a dash and using a function that accepts a SshHost for every invocation of git-annex.
How To Fix
Minimum fixed version
6.20170818
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update git-annex to the fixed version to mitigate the risk of exploitation.
Conclusion
The vulnerability in git-annex allows for command injection via a malicious SSH hostname, potentially leading to arbitrary code execution. Users should update their git-annex installation to version 6.20170818 or later to mitigate this risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-annex →
FAQ
git-annex is a tool that manages files with git, allowing users to store large files in a distributed way while keeping track of them in git.
The vulnerability allows an attacker to execute arbitrary code on the victim's system by manipulating the hostname in a git-annex repository URL.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. Updating git-annex to the fixed version is the recommended solution.
You can find more information about the fixed version (6.20170818) of git-annex on the official git-annex website or by referring to the release notes.
Related vulnerabilities
Recent vulnerabilities recorded for git-annex.
