CVE-2014-4511 Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrat...
HighCVSS 7.5
EPSS 82.7%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitlist | <= 0.4.0 | No fix listed |
| gitlist | = 0.1 | No fix listed |
| gitlist | = 0.2 | No fix listed |
| gitlist | = 0.3 | No fix listed |
References
- hatriot.github.io exploit
- packetstormsecurity.com exploit
- packetstormsecurity.com exploit
- 33929 exploit
- 33990 exploit
- groups.google.com