GitBucket Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in GitBucket version 4.23.1. This vulnerability allows unauthenticated attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload capabilities. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin through the git-lfs endpoint, and execute system commands via an exposed exploit endpoint.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server where GitBucket is running.

Reproduction

The vulnerability can be reproduced by first brute-forcing the Blowfish encryption key, which is used to authorize file uploads through the git-lfs endpoint. Once the key is obtained, a malicious JAR file can be uploaded as a plugin. After the plugin is loaded, commands can be executed on the system through the exploit endpoint.

Remediation

Users are advised to update GitBucket to version 4.24.1 or later.