<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
Last week we discovered a vulnerability in the Apache configuration
shipped with FusionForge, where the web server may execute scripts
that the users would have uploaded in their raw SCM repositories
(SVN, Git, Bzr...).<br>
<br>
This vulnerability, labelled CVE-2014-0468, can be exploited if you
provide file-level access (shell access, sftp access) to the <i>raw</i>
repositories (direct access bypassing the svn/git/etc. commands).<br>
Note: scripts committed normally to the repositories may not be
executed through this vulnerability.<br>
<br>
<br>
A fixed configuration is available at:<br>
<a class="moz-txt-link-freetext" href="https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git;a=blob;f=src/etc/httpd.conf.d/plugin-generic.inc;hb=HEAD">https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git;a=blob;f=src/etc/httpd.conf.d/plugin-generic.inc;hb=HEAD</a><br>
and reproduced below for reference.<br>
<br>
Since the installation process usually does not override
configuration files (because they may have been customized), make
sure you update your installed '<tt>/etc/<forge>/httpd.conf.d/plugin-generic.inc</tt>'
file manually.<br>
<br>
An updated 5.2 release is in preparation for new installations.<br>
(5.1 reached end of support, but the fix also applies to that
version)<br>
<br>
Regards,<br>
The FusionForge team.<br>
<br>
-----<br>
<br>
<pre>ScriptAliasMatch ^/plugins/([^/]*)/cgi-bin/(.*) {core/source_path}/plugins/$1/cgi-bin/$2
Alias {core/url_prefix}anonscm/ {core/data_path}/chroot/scmrepos/
<DirectoryMatch {core/data_path}/chroot/scmrepos/[^/]*>
Options -Indexes
</DirectoryMatch>
<DirectoryMatch {core/data_path}/chroot/scmrepos/[^/]*/.*>
# Enable directory index listing, but disable symlinks and CGI
Options Indexes
# Permit HTTP Auth for somewhat private projects (mechanism
# other than the SCM anon bit in the forge)
AllowOverride AuthConfig
# Prevent cookie theft in case a script does manage to execute
RequestHeader unset Cookie
# Disable all scripting engines (taken from Savannah)
# except for empty filenames == directory index
<Files "?*">
SetHandler default
</Files>
# Disable PHP5 explicitly for security (CVE-2014-0468)
<IfModule mod_php5.c>
php_admin_flag engine off
</IfModule>
</DirectoryMatch>
</pre>
</body>
</html>