CVE-2014-4511

EPSS 82.7%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 82.7%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

30 Jun 2014Metasploit module available

30 Jun 2014Public PoC

22 Jul 2014Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.

Affected products

n/a · n/a

public PoCs found — 7

githubgithub.com/michaelsss1/gitlist-RCE★ 0 cve_referencepacketstormsecurity.com/files/127364/Gitlist-Unauthenticated-Remote-Command-Execution.htmlunverified cve_referencewww.exploit-db.com/exploits/33929unverified cve_referencepacketstormsecurity.com/files/127281/Gitlist-0.4.0-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/33990unverified exploitdbwww.exploit-db.com/exploits/33929unverified cve_referencewww.exploit-db.com/exploits/33990unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://hatriot.github.io/blog/2014/06/29/gitlist-rce/http://packetstormsecurity.com/files/127281/Gitlist-0.4.0-Remote-Code-Execution.html http://packetstormsecurity.com/files/127364/Gitlist-Unauthenticated-Remote-Command-Execution.html https://groups.google.com/forum/#%21topic/gitlist/Hw_KdZfA4js http://www.exploit-db.com/exploits/33929 http://www.exploit-db.com/exploits/33990