Does gitolite provide an attack vector for the shellshock vulnerability?

Question

On the gitolite documentation page it says the following:

"Before running the command, however, sshd sets up an environment variable called SSH_ORIGINAL_COMMAND which contains the actual git command that your workstation sent out. This is the command that would have run if you did not have the command= part in the authorised keys file." how gitolite uses ssh

As I understand an attacker needs to be able to 1. control the content of an environment variable and 2. trigger the execution of any bash command, to be able to exploit the vulnerability.

It seems that 1 is possible with gitolite but is any bash code triggered after this environment variable was set?

Answer 1

You can check it like this:

env LC_FB='() { :;}; echo vulnerable' ssh [email protected]

With my gitlab user I saw vulnerable appear so I changed the shell to ZSH like this:

sudo chsh -s /bin/zsh git

Hope this helps.

Answer 2

If the user's login shell on the target machine is bash, or if the system shell (/bin/sh) is a link to bash and the user is able to invoke shell scripts (either directly or indirectly), then it does.