CVE-2018-1000533 : klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized in

klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.

Published 2018-06-26 16:29:02

Updated 2021-09-09 17:36:23

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2018-1000533

Gitlist » Gitlist
Versions up to, including, (<=) 0.6.0
cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-1000533

EPSS FAQ

97.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2018-1000533

GitList v0.6.0 Argument Injection Vulnerability

Disclosure Date: 2018-04-26

First seen: 2020-04-26

exploit/multi/http/gitlist_arg_injection

This module exploits an argument injection vulnerability in GitList v0.6.0. The vulnerability arises from GitList improperly validating input using the php function 'escapeshellarg'. Authors: - Kacper Szurek - Shelby Pace

More information

CVSS scores for CVE-2018-1000533

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-1000533

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1000533

https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html

Exploit/bypass PHP escapeshellarg/escapeshellcmd functions · security.szurek.pl
Exploit;Third Party Advisory
https://github.com/klaussilveira/gitlist/commit/87b8c26b023c3fc37f0796b14bb13710f397b322

Fixed RCE in git grep. · klaussilveira/gitlist@87b8c26 · GitHub
Patch;Third Party Advisory

Jump to