CVE-2017-1000214 (PHP, published 2017-11-27T14:29Z)
Description: value: GitPHP by xiphux is vulnerable to OS Command Injections
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Enalean/gitphp
Files changed:
include/controller/Controller_GraphData.class.php
include/git/FileBlame.class.php
include/git/FileHistory.class.php
include/git/FileSearch.class.php
include/git/TreeDiff.class.php
include/git/blob/BlobLoad_Base.class.php
include/git/commit/CommitLoad_Base.class.php
include/git/project/ProjectLoad_Git.class.php
include/git/reflist/RefListLoad_Git.class.php
include/git/revlist/RevList_Git.class.php
include/git/tag/TagLoad_Git.class.php
include/git/tree/TreeLoad_Base.class.php
include/git/tree/TreeLoad_Git.class.php
Commit message: Fix shell injections

No dynamic parameters should be passed shell_exec() without
being properly escaped


Vulnerable code:
			$commits = explode("\n", $this->exe->Execute($this->GetProject()->GetPath(), 'rev-list', array('--format=format:"%H %ct"', $head->GetHash())));
			$files = explode("\n", $this->exe->Execute($this->GetProject()->GetPath(), 'ls-tree', array('-r', '--name-only', $head->GetTree()->GetHash())));
		$args[] = $this->commitHash;
		$args[] = $this->path;
				$args[] = '--max-count=' . $this->limit;
				$args[] = '--skip=' . $this->skip;
				$args[] = '--max-count=' . ($this->limit + $this->skip);
		$args[] = $this->path;
		$args[] = $this->path;
		$args[] = '"' . addslashes($this->search) . '"';
		$args[] = $this->treeHash;
			$args[] = $this->fromHash;
		$args[] = $this->toHash;
		$args[] = $blob->GetHash();
		$args[] = $commit->GetHash();
		$args[] = $abbrevHash;
		$args[] = $hash;
		$args[] = '--' . $type;
		$args[] = '--sort=' . $order;
				$args[] = '--count=' . ($count + $skip);
				$args[] = '--count=' . $count;
		$args[] = 'refs/' . $type;
				$extraargs[] = '--max-count=' . $count;
				$extraargs[] = '--skip=' . $skip;
				$extraargs[] = '--max-count=' . ($count + $skip);
				$args[] = $objectHash;
		$args[] = $tree->GetHash();
		$args[] = $tree->GetHash();

Fixed code:
			$commits = explode("\n", $this->exe->Execute($this->GetProject()->GetPath(), 'rev-list', array('--format=format:"%H %ct"', escapeshellarg($head->GetHash()))));
			$files = explode("\n", $this->exe->Execute($this->GetProject()->GetPath(), 'ls-tree', array('-r', '--name-only', escapeshellarg($head->GetTree()->GetHash()))));
		$args[] = escapeshellarg($this->commitHash);
		$args[] = escapeshellarg($this->path);
				$args[] = '--max-count=' . escapeshellarg($this->limit);
				$args[] = '--skip=' . escapeshellarg($this->skip);
				$args[] = '--max-count=' . escapeshellarg($this->limit + $this->skip);
		$args[] = escapeshellarg($this->path);
		$args[] = escapeshellarg($this->path);
		$args[] = escapeshellarg($this->search);
		$args[] = escapeshellarg($this->treeHash);
			$args[] = escapeshellarg($this->fromHash);
		$args[] = escapeshellarg($this->toHash);
		$args[] = escapeshellarg($blob->GetHash());
		$args[] = escapeshellarg($commit->GetHash());
		$args[] = escapeshellarg($abbrevHash);
		$args[] = escapeshellarg($hash);
		$args[] = '--' . escapeshellarg($type);
		$args[] = '--sort=' . escapeshellarg($order);
				$args[] = '--count=' . escapeshellarg($count + $skip);
				$args[] = '--count=' . escapeshellarg($count);
		$args[] = escapeshellarg('refs/' . $type);
				$extraargs[] = '--max-count=' . escapeshellarg($count);
				$extraargs[] = '--skip=' . escapeshellarg($skip);
				$extraargs[] = '--max-count=' . escapeshellarg($count + $skip);
				$args[] = escapeshellarg($objectHash);
		$args[] = escapeshellarg($tree->GetHash());
		$args[] = escapeshellarg($tree->GetHash());