Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 4 Dec 2014 22:08:34 +0100
From: Dawa Ometto <>
To: <>
Subject: CVE request: remote code execution vulnerability in gollum < 4.0.1


I just released a fix for a remote code execution vulnerability in
gollum [1]. The vulnerable code was in the gollum-grit_adapter [2] ruby
gem dependency as of gollum v3.1.0, but the exploitable code was also
present before that version, in the gollum-lib [3] gem dependency (code
was abstracted from gollum-lib to the new dependency).

Type of vulnerability: remote code execution
Attack outcome: run arbitrary commands, shell access
Vulnerable versions: gollum < 3.1.1, gollum-lib < 4.0.1,
gollum-grit_adapter < 0.1.1
Fix: `gem update gollum` will update the dependencies.
Link to vulnerability/fix diff:
Link to project issue:

Description: The bug exploits the fact that gollum uses the grit gem for
git repository access, which makes command-line calls to `git grep` to
search files. `git grep` has an `-O` or `--open-files-in-pager` option
which can spawn an arbitrary process (to act as pager). In vulnerable
versions of gollum, searching for the string `-O<arbitrary command>` or
`--open-files-in-pager <arbritary command>` in the wiki's search field
will execute an arbitrary shell command. However, this will only work if
the string "master" (or more precisely, the name of the git branch that
gollum is using) is found in one of the wiki's files: "master" is then
interpreted as the search query, `-O<arbitary code>` as a command line
option to `git grep`.

The fix in the `gollum-grit_adapter` gem v.0.1.1 shell-escapes the
user's query and removes any -O or --open-file-in-pager option from it.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.