Internet Bug Bounty · Report #222020

Mercurial can be tricked into granting authorized users access to the Python debugger

Validstatus

highseverity

3upvotes

12 Jul 2017disclosed

Summary

Mercurial 4.1.3 (2017-4-18)

hg serve --stdio could be tricked into granting authorized users access to the Python debugger. Thanks to Jonathan Claudius of Mozilla for reporting this issue. This issue is only a security issue for repositories served using --stdio, which includes ssh but not http.

How it was found

I reported this bug privately to Mercurial and they produced an out of band release to fix the bug here:

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29

I produced a very detailed proof of concept with a Metasploit exploit module, which can be seen publicly here:

https://github.com/rapid7/metasploit-framework/pull/8263

The TLDR is that many services which host Mercurial servers often write their own hg-ssh wrapper or heavily customize the hg-ssh wrapper. If the customized wrapped does not explicitly validate user input to the repo attribute, an attacker can supply a string of "--debugger", which causes the internal hg binary to drop to a Pdb shell, which allows arbitrary Python code execution.

I'm submitting to this program because I believe source code management software like git and mercurial is considered critical infrastructure for the Internet.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original