On the gitolite documentation page it says the following:
"Before running the command, however, sshd sets up an environment variable called SSH_ORIGINAL_COMMAND which contains the actual git command that your workstation sent out. This is the command that would have run if you did not have the command= part in the authorised keys file." how gitolite uses ssh
As I understand an attacker needs to be able to 1. control the content of an environment variable and 2. trigger the execution of any bash command, to be able to exploit the vulnerability.
It seems that 1 is possible with gitolite but is any bash code triggered after this environment variable was set?