Vulnerability Report

Author: Matthew R. Bucci <bucci@sas.upenn.edu>
Date: 18 March, 2013

CVE-2013-2294

Description of Vulnerability:
-----------------------------
ViewGit "is a git web repository viewer that aims to be easy to set up
and upgrade, light on dependencies, and comfortable to use."
(http://viewgit.fealdia.org/).  
ViewGit contains multiple persistent arbitrary script injection (XSS)
vulnerabilities in its "Shortlog" and "Heads" tables.  These
vulnerabilities are triggered by malicious data inserted via the branch
or tag systems of git by one of the users of the repository.

Systems affected:  
-----------------
ViewGit 0.0.6 installed on CentOS 6.3 with PHP 5.3.3 and Apache 2.2.15
was tested and shown to be vulnerable.

Impact:
-------
Users viewing the ViewGit web interface could be exposed to arbitrary
HTML source authored by an attacker, including malicious Flash or Java
objects, remotely sourced iFrame tags, malicious JavaScript, or other
content, that would be associated with the trust zone of the ViewGit web
interface. This could result in bypass of cross site request forgery
mitigation, account compromise, drive by download attacks or other
impacts. For more information about the potential impacts of client side
attacks see the BeEF Project at http://beefproject.com/.

Mitigating factors:  
-------------------
In order to inject arbitrary script, attackers must have the ability to
manipulate the git repository. Specifically, the attacker must be able
to create branches or tags.

Proof of Concept Exploit:
-------------------------
Javascript commands, the most simple being
<script>alert("XSS")</script>, can be used as the name for either a tag
or branch in any given repository and subsequently executed by pulling
them up in ViewGit's web interface. Tag names will be executed when
viewing the "Shortlog" table, and branch names will be executed when
viewing the "Shortlog" or "Heads" tables.

Steps to Reproduce:
-------------------
There are two different avenues of attack, so here are two different
ways to reproduce the attack:

Branch name exploit:
1. Create a git repository and initialize it with "git init".
2. Add this repository to ViewGit by editing its localconfig.php file
and adding it to the 'projects' array.
3. Now, add a file to the repository and commit it with the commands
"git add fileName" and "git commit"
4. Add a branch via the command "git branch '<script>alert("XSS")</script>'"
5. Navigate to viewgit/?a=summary&p=X where X is the name of the
repository you set up.
6. Observe the Javascript pop-up.
7. Note that this same pop-up will appear when navigating to
viewgit/?a=shortlog&p=X, where X is the name of the repository you set
up, for the same reason because both pages use the same "Shortlog"
table. Thus both problems are also fixed by the same patch.

Tag name exploit:
1. Create a git repository and initialize it with "git init".
2. Add this repository to ViewGit by editing its localconfig.php file
and adding it to the 'projects' array.
3. Now, add a file to the repository and commit it with the commands
"git add fileName" and "git commit"
4. Add a tag via the command "git tag -a '<script>alert("XSS")</script>'
-m "Message""
5. Navigate to viewgit/?a=summary&p=X where X is the name of the
repository you set up.
6. Observe the Javascript pop-up.
7. Note that this same pop-up will appear when navigating to
viewgit/?a=shortlog&p=X, where X is the name of the repository you set
up, for the same reason because both pages use the same "Shortlog"
table. Thus both problems are also fixed by the same patch.

Vendor Response:
----------------
Vendor has been alerted to this vulnerability and has applied the
suggested patches to ViewGit version 0.0.7

Timeline:
---------
March 5th, Vulnerability discovered
March 5th, Vendor contact established
March 11th, Vendor provided with technical details
March 13th, Vendor acknowledged issue
March 16th, Patch committed in main branch of the ViewGit project by vendor
March 18th, Public release of advisory