A proof-of-concept of a vulnerability in custom shell prompt scripts

#1

Post by njhartwell » Fri, Mar 17, 2017, 8:34 PM UTC

A proof-of-concept of a vulnerability in custom shell prompt scripts
github.com

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#2

Post by ejcx » Fri, Mar 17, 2017, 8:55 PM UTC

Dang. Unfortunately I am not vulnerable, and I use default ohmyzsh.

This is a neat bug, though. Lots of package managers have similar problems, and I would not be surprised if there's a lot of git/shell/environment problems left to find.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#3

Post by SrslyJosh » Fri, Mar 17, 2017, 8:56 PM UTC

bash-git-prompt is vulnerable.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#4

Post by rahiel » Fri, Mar 17, 2017, 8:56 PM UTC

The "official" git prompt[1] is safe on Bash; the script doesn't run.

[1]: https://github.com/git/git/blob/master/contrib/completion/gi...

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#5

Post by pyreal » Fri, Mar 17, 2017, 8:56 PM UTC

Confirmed that default bash-it Git shell prompt is vulnerable on OS X.

https://github.com/Bash-it/bash-it

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#6

Post by klodolph » Fri, Mar 17, 2017, 8:57 PM UTC

Neat. My fancy Git prompt is a program I wrote in C, though. I'm sure it's vulnerable to something, but not to this. Maybe it should escape shell metacharacters in branch names, though.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#7

Post by artursapek » Fri, Mar 17, 2017, 8:58 PM UTC

rahiel wrote: post #4

The "official" git prompt[1] is safe on Bash; the script doesn't run. [1]: https://github.com/git/git/blob/master/contrib/completion/gi...

Nothing gets past Linus

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#8

Post by mikey_p » Fri, Mar 17, 2017, 8:58 PM UTC

On fish and omf here, not vulnerable. I suppose I should test fisherman on my other machine as well.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#9

Post by chadgeidel » Fri, Mar 17, 2017, 8:58 PM UTC

Forgive me if I'm misunderstanding the vulnerability, but isn't this one of Raymond Chen's "It rather involved being on the other side of this airtight hatchway" exploits? That is, any commands you run has the same permissions as you have.

Now, I understand that you may not intimately understand 100% the code of the commands and shell extensions you use, but is that a "vulnerability"?

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#10

Post by eridius » Fri, Mar 17, 2017, 8:59 PM UTC

Confirmed that the official git prompt for Fish is not vulnerable.