CVE-2018-11235 PoC — Git 安全漏洞

Source

https://github.com/xElkomy/CVE-2018-11235

Associated Vulnerability

Title:Git 安全漏洞 (CVE-2018-11235)
Description:In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

Readme

# CVE-2018-11235

File Snapshot


 [4.0K]  /data/pocs/7f8871865c205d3aac17805e376d807ad631b800
├── [4.0K]  evil
│   ├── [ 355]  index.html
│   ├── [ 780]  README.md
│   └── [ 256]  styles.css
├── [4.0K]  modules
│   └── [4.0K]  1
│       └── [4.0K]  2
│           └── [4.0K]  3
│               └── [4.0K]  4
│                   └── [4.0K]  evil
│                       ├── [ 289]  config
│                       ├── [  73]  description
│                       ├── [  23]  HEAD
│                       ├── [4.0K]  hooks
│                       │   ├── [ 478]  applypatch-msg.sample
│                       │   ├── [ 896]  commit-msg.sample
│                       │   ├── [4.5K]  fsmonitor-watchman.sample
│                       │   ├── [ 115]  post-checkout
│                       │   ├── [ 189]  post-update.sample
│                       │   ├── [ 424]  pre-applypatch.sample
│                       │   ├── [1.6K]  pre-commit.sample
│                       │   ├── [ 416]  pre-merge-commit.sample
│                       │   ├── [1.5K]  prepare-commit-msg.sample
│                       │   ├── [1.3K]  pre-push.sample
│                       │   ├── [4.8K]  pre-rebase.sample
│                       │   ├── [ 544]  pre-receive.sample
│                       │   └── [3.5K]  update.sample
│                       ├── [ 297]  index
│                       ├── [4.0K]  info
│                       │   └── [ 240]  exclude
│                       ├── [4.0K]  logs
│                       │   ├── [ 208]  HEAD
│                       │   └── [4.0K]  refs
│                       │       ├── [4.0K]  heads
│                       │       │   └── [ 208]  master
│                       │       └── [4.0K]  remotes
│                       │           └── [4.0K]  origin
│                       │               └── [ 208]  HEAD
│                       ├── [4.0K]  objects
│                       │   ├── [4.0K]  03
│                       │   │   └── [ 448]  50da31ba1fff7f40d7b57a533381722c0f9fc7
│                       │   ├── [4.0K]  58
│                       │   │   └── [ 162]  060701b538587e8b4ab127253e6ed6fbdc53d1
│                       │   ├── [4.0K]  6f
│                       │   │   └── [ 451]  f2eef8481ddfb6e74befa39d6f73c3cb2f87a6
│                       │   ├── [4.0K]  9b
│                       │   │   ├── [ 174]  8528455cf79bca41ac100bcb531fcbf580985e
│                       │   │   └── [  55]  fbcbc67545f6b5870e9c8f3687943b9cd3f205
│                       │   ├── [4.0K]  a3
│                       │   │   └── [ 164]  0c19e3f13765a3b48829788bc1cb8b4e95cee4
│                       │   ├── [4.0K]  a6
│                       │   │   └── [ 123]  39e96f9038797fba6e0469f94a4b0cc459fa68
│                       │   ├── [4.0K]  a8
│                       │   │   └── [ 260]  3618bcf17b4e8e643de75d09adc0e892043020
│                       │   ├── [4.0K]  bb
│                       │   │   └── [ 188]  4cc8d3b2e14b3af5df699876dd4ff3acd00b7f
│                       │   ├── [4.0K]  c9
│                       │   │   └── [ 123]  c11edf6c3c78b00af1c47ebf12c099845f356c
│                       │   ├── [4.0K]  d0
│                       │   │   └── [ 174]  dd1f61b33d64e29d8bc1372a94ef6a2fee76a9
│                       │   ├── [4.0K]  d3
│                       │   │   └── [ 152]  17fd9e78e5002007db3f80ceb010a41181185e
│                       │   ├── [4.0K]  d7
│                       │   │   ├── [  19]  2af314604e3b98e5c108efeb4815c64d2e267b
│                       │   │   └── [ 123]  cee29eaada459ba458a63ad983a89915c6a10a
│                       │   └── [4.0K]  f4
│                       │       ├── [ 166]  39fc5710cd87a4025247e8f75901cdadf5333d
│                       │       └── [ 454]  790267d0d362a90d6799759ece092616c40779
│                       ├── [ 265]  packed-refs
│                       └── [4.0K]  refs
│                           ├── [4.0K]  heads
│                           │   └── [  41]  master
│                           └── [4.0K]  remotes
│                               └── [4.0K]  origin
│                                   └── [  32]  HEAD
├── [  17]  README.md
└── [4.0K]  Spoon-Knife
    ├── [ 355]  index.html
    ├── [ 780]  README.md
    └── [ 256]  styles.css

33 directories, 47 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!