#12 Security: repo name command injection in smart HTTP clone
closed
Opened by atgreen
From secscan triage. Severity: HIGH. CWE-78.
Source: authenticated repo creation accepts the repository name from POST/API input and stores it without slug validation (src/server.lisp:880, src/server.lisp:2323, src/model.lisp:281).
Sink: handle-git-http builds a shell command string for smart HTTP upload-pack with the repo disk path inside raw single quotes (src/server.lisp:2677-2679). A repo name containing a single quote and shell metacharacters can break out of the quoted path when POST /OWNER/REPO.git/git-upload-pack is handled.
Exploit sketch: create/import a repo with a name like x' ; touch /tmp/cave-pwned ; #, then trigger the smart HTTP clone POST for that repo. The command formatted as git upload-pack --stateless-rpc '...' < ... > ... executes the injected shell fragment as the Cave server user.
Recommendation: replace this shell-form uiop:run-program call with argv-based execution and explicit stdin/stdout streams. Also add strict owner/repo slug validation before insert so names cannot contain quotes, slashes, whitespace, or shell metacharacters.
Note: triage candidate requiring human review; source verified, PoC not executed.
Fixed in commit 0e33dbc (Fix smart HTTP upload-pack command injection). The smart HTTP upload-pack POST path now invokes git with argv plus explicit input/output files instead of formatting a shell command with the repo path.