Description (CNA)
Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| nesquena / hermes-webui | affected 0 before 0.51.311 |
CWE
CWE-78
References
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.311
- https://github.com/nesquena/hermes-webui/pull/3776
- https://github.com/nesquena/hermes-webui/commit/938ac9f55b53def1eefb48c4c42dabaf9c22e99c
- https://www.vulncheck.com/advisories/hermes-webui-rce-via-git-configuration-injection
ADP enrichment
No English description supplied.
No references supplied.