On the gitolite documentation page it says the following:

"Before running the command, however, sshd sets up an environment variable called SSH_ORIGINAL_COMMAND which contains the actual git command that your workstation sent out. This is the command that would have run if you did not have the command= part in the authorised keys file." how gitolite uses ssh

As I understand an attacker needs to be able to 1. control the content of an environment variable and 2. trigger the execution of any bash command, to be able to exploit the vulnerability.

It seems that 1 is possible with gitolite but is any bash code triggered after this environment variable was set?

2 Answers 2


You can check it like this:

env LC_FB='() { :;}; echo vulnerable' ssh [email protected]

With my gitlab user I saw vulnerable appear so I changed the shell to ZSH like this:

sudo chsh -s /bin/zsh git

Hope this helps.

  • Thanks, i just tested your script and it definitely provides the possibility for added users to execute commands that they shouldn't. I will look into how i best prevent this.
    – samy
    Sep 26, 2014 at 12:33
  • @hamstar What is LC_FB used for? I tried to google it but no luck.
    – musiKk
    Sep 30, 2014 at 11:46
  • I not too sure, I think it's just the name for the variable. You could probably change it to anything and get the same result.
    – hamstar
    Nov 4, 2014 at 3:07

If the user's login shell on the target machine is bash, or if the system shell (/bin/sh) is a link to bash and the user is able to invoke shell scripts (either directly or indirectly), then it does.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .