ID:6172 - Exploit for Path traversal in cgit - CVE-2018-14912

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in cgit_clone_objects due to path traversal when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. A remote unauthenticated attacker can conduct directory traversal attack and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation