CVE-2008-5517: The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot…

PriorityP261high7.5CVSS 2.0

AVNACLAuNCPIPAP

EXPLOIT

EPSS

11.88%

95.6th percentile

The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object.

Affected

38 ranges· showing 25

Vendor	Product	Version range	Fixed in
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://server/cgi-bin/gitweb.cgi?p=sample.git/.git;a=object;f=program.c;h=e69de29bb2d1d6434b8b29ae775ad8c2e48c5391|`touch$IFS/tmp/file.txt`|;hb=9adaf5b35bb6415497d23f089660567227ea3785↗

path/cgi-bin/gitweb.cgi↗

commandtouch$IFS/tmp/file.txt↗

→Monitor HTTP requests to gitweb.cgi where the 'h' or 'hb' parameters contain shell metacharacters such as pipe (|), backtick (`), semicolon (;), or $IFS — these are indicators of blind command injection via git_object(). ↗
→Alert on gitweb CGI requests with the query parameter 'a=object' or 'a=snapshot' combined with unsanitized special characters in hash parameters (h=, hb=, f=), as these map to the vulnerable git_object() and git_snapshot() functions. ↗
→The exploit uses $IFS as a space substitute to bypass naive input filtering — detect URL-encoded or literal $IFS in CGI query strings targeting gitweb. ↗
→The vulnerability is a blind command injection (no output returned); detection should focus on anomalous side-effects such as unexpected process spawning from the web server user, rather than response content. ↗
→The root cause is unsanitized input passed to Perl's open() with '-|' (pipe open); audit gitweb.cgi for uses of open() that incorporate user-controlled parameters without quoting. ↗

·CVE-2008-5517 affects gitweb 1.5.x before 1.5.6 specifically for git_snapshot and git_object; the related CVE-2008-5516 covers git_search in versions before 1.5.5. Both must be patched independently. ↗
·The upstream fix applies quote_command() to sanitize all three vulnerable open() call sites (git_snapshot, git_object, git_search); partial patching leaves residual injection vectors. ↗
·EPEL/EL-4 packages at git-1.5.4.7 are vulnerable to both CVE-2008-5516 and CVE-2008-5517 despite the version number appearing to predate the stated 'first fixed in' versions — the 'first occurred in' language in upstream commits refers to when the fix landed, not when the bug was introduced. ↗

CVSS provenance

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_redhat7.5HIGH

vendor_ubuntu7.5HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Vendor	Product	Version range	Fixed in
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—

Vendor	Product	Version range	Fixed in
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—

Vendor	Product	Version range	Fixed in
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—
git	git	—	—