medium6.5Public exploit code
CVE-2013-4490
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authentica…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Gitlab-shell - Code Execution (Metasploit)2014-08-19 · remote · linux · Verified
Impact
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitlab | Gitlab | Versions 5.0.0, 5.0.1, 5.1.0, 5.2.0, 5.3.0, 5.4.0 |
| Gitlab | Gitlab-Shell | through 1.7.2 Versions 1.0.4, 1.1.0, 1.2.0, 1.3.0, 1.4.0 |