Vulnerability Report Author: Matthew R. Bucci <bucci@sas.upenn.edu> Date: 18 March, 2013 CVE-2013-2294 Description of Vulnerability: ----------------------------- ViewGit "is a git web repository viewer that aims to be easy to set up and upgrade, light on dependencies, and comfortable to use." (http://viewgit.fealdia.org/). ViewGit contains multiple persistent arbitrary script injection (XSS) vulnerabilities in its "Shortlog" and "Heads" tables. These vulnerabilities are triggered by malicious data inserted via the branch or tag systems of git by one of the users of the repository. Systems affected: ----------------- ViewGit 0.0.6 installed on CentOS 6.3 with PHP 5.3.3 and Apache 2.2.15 was tested and shown to be vulnerable. Impact: ------- Users viewing the ViewGit web interface could be exposed to arbitrary HTML source authored by an attacker, including malicious Flash or Java objects, remotely sourced iFrame tags, malicious JavaScript, or other content, that would be associated with the trust zone of the ViewGit web interface. This could result in bypass of cross site request forgery mitigation, account compromise, drive by download attacks or other impacts. For more information about the potential impacts of client side attacks see the BeEF Project at http://beefproject.com/. Mitigating factors: ------------------- In order to inject arbitrary script, attackers must have the ability to manipulate the git repository. Specifically, the attacker must be able to create branches or tags. Proof of Concept Exploit: ------------------------- Javascript commands, the most simple being <script>alert("XSS")</script>, can be used as the name for either a tag or branch in any given repository and subsequently executed by pulling them up in ViewGit's web interface. Tag names will be executed when viewing the "Shortlog" table, and branch names will be executed when viewing the "Shortlog" or "Heads" tables. Steps to Reproduce: ------------------- There are two different avenues of attack, so here are two different ways to reproduce the attack: Branch name exploit: 1. Create a git repository and initialize it with "git init". 2. Add this repository to ViewGit by editing its localconfig.php file and adding it to the 'projects' array. 3. Now, add a file to the repository and commit it with the commands "git add fileName" and "git commit" 4. Add a branch via the command "git branch '<script>alert("XSS")</script>'" 5. Navigate to viewgit/?a=summary&p=X where X is the name of the repository you set up. 6. Observe the Javascript pop-up. 7. Note that this same pop-up will appear when navigating to viewgit/?a=shortlog&p=X, where X is the name of the repository you set up, for the same reason because both pages use the same "Shortlog" table. Thus both problems are also fixed by the same patch. Tag name exploit: 1. Create a git repository and initialize it with "git init". 2. Add this repository to ViewGit by editing its localconfig.php file and adding it to the 'projects' array. 3. Now, add a file to the repository and commit it with the commands "git add fileName" and "git commit" 4. Add a tag via the command "git tag -a '<script>alert("XSS")</script>' -m "Message"" 5. Navigate to viewgit/?a=summary&p=X where X is the name of the repository you set up. 6. Observe the Javascript pop-up. 7. Note that this same pop-up will appear when navigating to viewgit/?a=shortlog&p=X, where X is the name of the repository you set up, for the same reason because both pages use the same "Shortlog" table. Thus both problems are also fixed by the same patch. Vendor Response: ---------------- Vendor has been alerted to this vulnerability and has applied the suggested patches to ViewGit version 0.0.7 Timeline: --------- March 5th, Vulnerability discovered March 5th, Vendor contact established March 11th, Vendor provided with technical details March 13th, Vendor acknowledged issue March 16th, Patch committed in main branch of the ViewGit project by vendor March 18th, Public release of advisory