cbcvebase.
CVE-2017-9800
published 2017-08-11

CVE-2017-9800: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an…

PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
18.89%
97.0th percentile
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.

Affected

47 ranges· showing 25
VendorProductVersion rangeFixed in
apachesubversion<= 1.8.18
apachesubversion
apachesubversion
apachesubversion
apachesubversion
apachesubversion
apachesubversion
apachesubversion
apachesubversion
apachesubversion
apachesubversion>= 0 < 1.9.7-11.9.7-1
apachesubversion>= 0 < 1.9.7-11.9.7-1
apachesubversion>= 0 < 1.9.7-11.9.7-1
apachesubversion>= 0 < 1.9.7-11.9.7-1
apachesubversion>= 0 < 1.8.8-1ubuntu3.31.8.8-1ubuntu3.3
apachesubversion>= 0 < 1.9.3-2ubuntu1.11.9.3-2ubuntu1.1
apache_software_foundationapache_subversion
apache_software_foundationapache_subversion
applexcode_9
canonicalbazaar<= 2.7.0
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debianbreezy< breezy 3.0.0~bzr6772-1 (bookworm)breezy 3.0.0~bzr6772-1 (bookworm)
debianbzr< breezy 3.0.0~bzr6772-1 (bookworm)breezy 3.0.0~bzr6772-1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

urlsvn+ssh://-eProxyCommand=<payload>
othersvn+ssh URL with initial dash character in hostname
  • Detect svn+ssh:// URLs where the hostname begins with a dash character, which is the attack primitive for CVE-2017-9800 — these are passed unsanitised to the SSH client and interpreted as SSH flags.
  • Monitor for svn:externals or svn:sync-from-url properties containing svn+ssh:// URLs with a leading dash in the hostname, as these are the two SVN metadata fields weaponised to deliver the malicious URL to victim clients.
  • The attack vector is not limited to svn:// transport — all Subversion client transports (file://, http://, plain svn://) are affected because the malicious URL is embedded in repository metadata, not the transport itself.
  • Flag Bazaar (bzr) usage of bzr+ssh:// URLs where the hostname starts with a dash — the same SSH option-injection pattern applies to Bazaar's Subprocess SSH backend.
  • Flag git-annex ssh:// URLs with an initial dash in the hostname (e.g. ssh://-eProxyCommand=…) as the same SSH option-injection class of attack.
  • Treat a malicious server, a malicious committer to a shared repository, or a proxy server as equally valid threat actors — all three can inject the malicious svn+ssh URL to attack other clients.
  • ·Affected Subversion client versions are 1.0.0–1.8.18, 1.9.0–1.9.6, and 1.10.0-alpha1–1.10.0-alpha3; versions 1.8.19, 1.9.7+, and later 1.10.x are patched.
  • ·Bazaar is only vulnerable when the Subprocess SSH backend is in use; other SSH backends may not be affected.

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_apache9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu6.8MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.