CVE-2016-7794
📋 TL;DR
This vulnerability in sociomantic-tsunami git-hub allows remote attackers to execute arbitrary code by using a specially crafted repository name. It affects all users running git-hub versions before 0.10.3. The vulnerability stems from improper access control (CWE-284) that enables command injection.
💻 Affected Systems
- sociomantic-tsunami git-hub
📦 What is this software?
Git Hub by Sociomantic
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution as the user running git-hub, potentially leading to data theft, system takeover, or lateral movement.
Likely Case
Remote attackers gain shell access on the affected system, allowing them to execute commands, access sensitive data, or install malware.
If Mitigated
If proper network segmentation and least privilege principles are applied, impact could be limited to the git-hub service account and isolated systems.
🎯 Exploit Status
The vulnerability is publicly documented with proof-of-concept details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.10.3 and later
Vendor Advisory: https://github.com/sociomantic-tsunami/git-hub/issues/197
Restart Required: Yes
Instructions:
1. Stop git-hub service. 2. Update to version 0.10.3 or later using package manager or manual installation. 3. Restart git-hub service.
🔧 Temporary Workarounds
Disable git-hub service
linuxTemporarily disable the git-hub service until patching can be completed
sudo systemctl stop git-hub
sudo systemctl disable git-hub
Network isolation
linuxRestrict network access to git-hub service using firewall rules
sudo iptables -A INPUT -p tcp --dport [git-hub-port] -j DROP
🧯 If You Can't Patch
- Implement strict input validation for repository names
- Run git-hub with minimal privileges in a containerized or isolated environment
🔍 How to Verify
Check if Vulnerable:
Check git-hub version: git-hub --version | grep -E '0\.(9|10\.(0|1|2))'Check Version:
git-hub --versionVerify Fix Applied:
Verify version is 0.10.3 or later: git-hub --version | grep -E '0\.(10\.([3-9]|[1-9][0-9])|1[1-9]|2[0-9])'📡 Detection & Monitoring
Log Indicators:
- Unusual repository name patterns in git-hub logs
- Shell command execution from git-hub process
Network Indicators:
- Unexpected outbound connections from git-hub service
- Command and control traffic patterns
SIEM Query:
process:git-hub AND (cmdline:*sh* OR cmdline:*bash* OR cmdline:*curl* OR cmdline:*wget*)🔗 References
- http://www.openwall.com/lists/oss-security/2016/09/30/2
- http://www.securityfocus.com/bid/93249
- https://github.com/sociomantic-tsunami/git-hub/issues/197
- http://www.openwall.com/lists/oss-security/2016/09/30/2
- http://www.securityfocus.com/bid/93249
- https://github.com/sociomantic-tsunami/git-hub/issues/197
