Introduction
Three individually modest weaknesses in GitBucket 4.23.1 combine into one unauthenticated remote code execution path on Windows installations. An attacker brute forces a Blowfish key that has only 10,000 possible values, traverses directories with backslashes in the Git LFS upload endpoint, and then relies on automatic plugin loading. That takes them from zero access to full system command execution without any credentials.
GitBucket is an open-source, self-hosted Git platform built on Scala, with an emphasis on easy installation and GitHub API compatibility. Organizations use it for lightweight, extensible Git infrastructure, and it supports public and private repositories, SSH access, Git LFS, and a plugin system. The plugin architecture and LFS support are useful features, and they are also the attack surface for this vulnerability.
Technical Information
Together, the three weaknesses in CVE-2018-25332 let a completely unauthenticated attacker achieve remote code execution on Windows-hosted GitBucket instances.
Weak Blowfish Token Generation
Requests to the Git LFS API require an authorization token. GitBucket generates this token with Blowfish encryption, but the key derivation is critically flawed. The BlowfishKey variable is built from only the last four digits of the current system timestamp, so there are at most 10,000 possible keys. An attacker can brute force the correct key by sending a crafted token for each candidate key and watching for HTTP responses that are not a 500 status code. A successful non-error response means the attacker has found the key.
Windows Backslash Path Traversal in Git LFS
The traversal starts in the unrestricted file upload functionality of the Git LFS transfer servlet. The getPathInfo function splits the requested URL on the forward slash character to extract the owner, repository, and object ID. On Windows, backslash characters also traverse directories. Because the function only splits on forward slashes, an attacker can inject backslashes into the object ID parameter.
The application then passes this unvalidated object ID straight to the Java file creation function via getLfsFilePath. The attacker can write files to arbitrary directories, including the plugins folder.
Automatic Plugin Loading and Execution
GitBucket has a PluginWatchThread class that continuously monitors the plugins directory and automatically installs and activates new extensions. With the brute-forced token and the path traversal, an attacker can upload a malicious compiled Scala JAR file directly into the plugins directory. Once the server loads the plugin, the attacker triggers remote code execution by requesting an exposed web endpoint. The publicly available proof of concept uses the Scala !! operator to pass parameters directly to the system command execution function.
Full Exploit Chain
The attack has four discrete steps:
| Step | Component Abused | Action Performed |
|---|---|---|
| 1 | API Endpoint | Identify GitBucket installation via rate limit URL response |
| 2 | Authorization Header | Brute force 10,000 possible Blowfish keys to obtain a valid token |
| 3 | Git LFS API | Upload malicious JAR file using backslash path traversal to the plugins directory |
| 4 | PluginWatchThread | Wait for automatic plugin loading, then execute commands via web request |
The CWE classification is CWE-306 (Missing Authentication for Critical Function). That matches the core issue, which is that the LFS upload path and the plugin loading mechanism lack adequate authentication and authorization controls.
Platform Considerations
The unauthenticated RCE only works on Windows installations, because the path traversal depends on backslash directory separators. An authenticated arbitrary file read vulnerability affects all platforms, though, so non-Windows deployments are still partly exposed.
Affected Systems and Versions
GitBucket 4.23.1 and all earlier versions are vulnerable to the full unauthenticated remote code execution chain on Windows. The fixes arrived in stages across several releases:
- Version 4.24.0: Resolves the remote code execution vulnerability
- Version 4.24.1: Fixes a Web API authentication bug
- Version 4.25.0: Resolves the weak security token generation. This is the first version where both the path traversal and the cryptographic weakness are fully eliminated
Treat any GitBucket installation on Windows running a version prior to 4.25.0 as at risk.
Vendor Security History
The GitBucket maintainers responded with three sequential patches in quick succession. Version 4.24.0 shipped on April 30, 2018, and addressed the RCE. Version 4.24.1 followed on May 1, 2018, with a fix for a Web API authentication bug. Version 4.25.0 completed the remediation by resolving the underlying token weakness. The plugin system and LFS support, both core extensibility features of the platform, contributed directly to the attack surface this CVE exploited.
References
- NVD Entry for CVE-2018-25332
- GitBucket GitHub Repository
- GitBucket 4.23.1 Unauthenticated Remote Code Execution (Kacper Szurek)
- Exploit Database: GitBucket 4.23.1 Remote Code Execution (EDB 44668)
- VulnCheck Advisory: GitBucket Unauthenticated Remote Code Execution
- GitBucket 4.25.0 Release Notes
- GitBucket CHANGELOG
