“An email address like a`touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash's maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository.”

Hacktron blog · Hacktron finds 26 vulnerabilities in GNU Savannah that could have backdoored Bash

“Savannah is where much of the GNU userland lives, including Bash and Coreutils, which provides commands such as ls, cp, and rm. It holds the repositories, the maintainer accounts, and the SSH keys that decide who can push.”

Hacktron blog · Hacktron finds 26 vulnerabilities in GNU Savannah that could have backdoored Bash

“The email is appended to $options as plain text, $options is concatenated into $cmd, and utils_run_proc() hands that string to proc_open(). With a string command, PHP runs it through /bin/sh.”

Hacktron blog · Hacktron finds 26 vulnerabilities in GNU Savannah that could have backdoored Bash

“Like much of the infrastructure free software depends on, it's run by a handful of volunteers and FSF staff with limited resources.”

Hacktron blog · Hacktron finds 26 vulnerabilities in GNU Savannah that could have backdoored Bash