On the gitolite documentation page it says the following:

"Before running the command, however, sshd sets up an environment variable called SSH_ORIGINAL_COMMAND which contains the actual git command that your workstation sent out. This is the command that would have run if you did not have the command= part in the authorised keys file." how gitolite uses ssh

As I understand an attacker needs to be able to 1. control the content of an environment variable and 2. trigger the execution of any bash command, to be able to exploit the vulnerability.

It seems that 1 is possible with gitolite but is any bash code triggered after this environment variable was set?


You can check it like this:

env LC_FB='() { :;}; echo vulnerable' ssh git@yourserver.com

With my gitlab user I saw vulnerable appear so I changed the shell to ZSH like this:

sudo chsh -s /bin/zsh git

Hope this helps.

  • Thanks, i just tested your script and it definitely provides the possibility for added users to execute commands that they shouldn't. I will look into how i best prevent this. – samy Sep 26 '14 at 12:33
  • @hamstar What is LC_FB used for? I tried to google it but no luck. – musiKk Sep 30 '14 at 11:46
  • I not too sure, I think it's just the name for the variable. You could probably change it to anything and get the same result. – hamstar Nov 4 '14 at 3:07

If the user's login shell on the target machine is bash, or if the system shell (/bin/sh) is a link to bash and the user is able to invoke shell scripts (either directly or indirectly), then it does.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.