Researchers backdoored Bash on GNU Savannah via email injection
Original title: Securing Internet-Critical Software: How We Could Have Backdoored Bash
Email injection enabled RCE, superuser access, and push to Bash repo; FSF fixed 26 Savane vulnerabilities after report.
Researchers discovered that an email address containing shell metacharacters like backticks executes commands on GNU Savannah's Savane forge. They gained code execution as the web server user, set their account as superuser, impersonated the Bash maintainer, and obtained root access via an unpatched kernel. They reported the issues to the FSF, who fixed 26 vulnerabilities across the forge.
Unconfirmed: Exact potential for further damage by the initial exploit is unknown
- Email validator accepts shell metacharacters
- GPG key test runs commands with user email
- Fixed 26 vulnerabilities in Savane
- Affected savannah.gnu.org and savannah.nongnu.org
- Unpatched kernel enabled root access
Impact: code execution as web server user and root access to backend
- 1.Update Savane to latest version
- 2.Audit Savane for similar injection issues
From the original article
6 min read at hacktron.ai
Securing Internet-Critical Software: How We Could Have Backdoored Bash A shell injection hidden in an email address gave us code execution on GNU Savannah, then root, then the ability to push to the upstream Bash repository. We reported it, kept auditing, and helped the FSF fix 26 vulnerabilities in the forge that hosts GNU. TL;DR: GNU Savannah hosts Bash, Coreutils, and hundreds of other GNU projects.
By hacktron.ai via demiguru · hacktron.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.