Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proof-of-concept of a vulnerability in custom shell prompt scripts

github.com

Post reply on HN
Print view View original

31–40 of 54 posts

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#31

Post by caust1c »

Ajedi32 wrote: post #25
ejcx wrote: post #2

Dang. Unfortunately I am not vulnerable, and I use default ohmyzsh. This is a neat bug, though. Lots of package managers have similar problems, and I would not be surprised if there's a lot of git/shell/environment problems left to find.

Why is it unfortunate that you're not vulnerable? Isn't that a good thing?

He's an applications security researcher. That stuff is fun for him.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#32

Post by adito »

caf wrote: post #14
rahiel wrote: post #4

The "official" git prompt[1] is safe on Bash; the script doesn't run. [1]: https://github.com/git/git/blob/master/contrib/completion/gi...

In particular see the long comment at line 324.

> If the shell would expand the contents of PS1 when drawing the prompt, a raw ref name must not be included in PS1. This protects the user from arbitrary code execution via specially crafted ref names. For example, a ref named 'refs/heads/$(IFS=_;cmd=sudo_rm_-rf_/;$cmd)' might cause the shell to execute 'sudo rm -rf /' when the prompt is drawn.

[1]: https://github.com/git/git/blob/9d77b0405ce6b471cb5ce3a90436...

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#34

Post by vortico »

caust1c wrote: post #30
ejcx wrote: post #2

Dang. Unfortunately I am not vulnerable, and I use default ohmyzsh. This is a neat bug, though. Lots of package managers have similar problems, and I would not be surprised if there's a lot of git/shell/environment problems left to find.

Oh god why. Use https://github.com/sorin-ionescu/prezto

Are you not going to give a reason?

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#36

Post by graton »

artursapek wrote: post #7
rahiel wrote: post #4

The "official" git prompt[1] is safe on Bash; the script doesn't run. [1]: https://github.com/git/git/blob/master/contrib/completion/gi...

Nothing gets past Linus

That code appears to be written by someone named Richard Hansen. I don't even see Linus in the git blame output of that file.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#37

Post by moyix »

rahiel wrote: post #4

The "official" git prompt[1] is safe on Bash; the script doesn't run. [1]: https://github.com/git/git/blob/master/contrib/completion/gi...

It looks like it used to, but was fixed by this patch:

https://github.com/git/git/commit/8976500cbbb13270398d3b3e07...

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#38

Post by oconnor663 »

abbeyj wrote: post #26

Tab autocompletion looks to be affected too, at least on my system. Create a branch called 'complete_$(./foo)'. Then type 'git checkout comp '. This gets autocompleted to git checkout complete_$(./foo) If you hit Enter at this point without thinking you'll end up running './foo'. It should have expanded instead to something like git checkout 'complete_$(./foo)' or git checkout complete_\$\(./foo\)

Zsh seems to do the escaping correctly there.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#40

Post by koolba »

It's always cute to find new vectors for command injection. Really anytime you mix data and commands this type of crap is bound to happen (ex: sql injection).

Still not as worrisome to me as the full scripts that get executed by package managers when you install dependencies. Effectively every time you run something like "npm install" you're putting your faith in the entire tree of ancestor dependencies as any of them could have a pwnage script as a post install.

Post reply on HN