NetSight
IP …
high8.8Public exploit code

CVE-2017-1000117

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

Affected products

VendorProductAffected versions
Git-ScmGit
through 2.7.5
Versions 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4

Weakness classification

CWE-601

References