Vulnerabilities reported by Justin Steven #21
Assignees
Labels
Comments
WangYihang
added a commit
that referenced
this issue
Jan 31, 2022
When GitHacker meets Apache/Nginx with folder Indexes enabled, it will recursively download `.git` folder. GitHacker incorrectly trust the hyperlink from the Apache/Nginx, that allows to write arbitrary content into arbitrary file on the GitHacker users machine. This issue is reported by Justin Steven <https://twitter.com/justinsteven>. Thanks a lot for his excellent work and his responsible disclosure.
WangYihang
added a commit
that referenced
this issue
Jan 31, 2022
When GitHacker meets Apache/Nginx with folder Indexes enabled, it will recursively download `.git` folder. GitHacker incorrectly trust the hyperlink from the Apache/Nginx, that allows to write arbitrary content into arbitrary file on the GitHacker users machine. This issue is reported by Justin Steven <https://twitter.com/justinsteven>. Thanks a lot for his excellent work and his responsible disclosure.
WangYihang
added a commit
that referenced
this issue
Mar 1, 2022
WangYihang
added a commit
that referenced
this issue
Mar 1, 2022
…ooks/*` this vulnerability is cause by unexpected trust of `core.fsmonitor` in `.git/config` and `.git/hooks/*`. these git files could be dangerous when GitHacker is interacting with git. so, to prevent the user of GitHacker from malicous remote `.git` folder, GitHacker will not download these files by default. But, if you insist, you can enable downloading them by provide the command line argument: `--enable-manually-check-dangerous-git-files=false`, then GitHacker will display the content fo the dangerous files before saving into the temporary repo folder. NOTICE, you should be very careful with those files. I highly recommend you run GitHacker in a jailed environment such as Docker container.
WangYihang
added a commit
that referenced
this issue
Mar 4, 2022
…hooks/*` this vulnerability is cause by unexpected trust of some dangerous configs in `.git/config` and `.git/hooks/*`. these git files could be dangerous when GitHacker is interacting with git. so, to prevent the user of GitHacker from malicous remote `.git` folder, GitHacker will not download these files by default. But, if you insist, you can enable downloading them by provide the command line argument: `--enable-manually-check-dangerous-git-files=false`, then GitHacker will display the content fo the dangerous files before saving into the temporary repo folder. NOTICE, you should be very careful with those files. I highly recommend you run GitHacker in a jailed environment such as Docker container.
WangYihang
added a commit
that referenced
this issue
Jul 26, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
No description provided.
The text was updated successfully, but these errors were encountered: