---
layout: post
title: "Gitlab-shell is affected by Bash CVE-2014-6271"
date: 2014-09-24
comments: true
categories:
author: Jacob Vosmaer
---

Today a security vulnerability in Bash (CVE-2014-6271) was announced that can
be exploited against the OpenSSH daemon. On GitLab servers where the default
shell of the `git` user is Bash (or Bash masquerading as `sh`) this allows for
remote code execution as the `git` user for attackers who have uploaded their
SSH key to GitLab.

<!--more-->

## Detection

Asssuming your SSH key is in GitLab, you can test for this vulnerability with
the following command:

```
ssh  git@gitlab.example.com '() { ignored; }; /usr/bin/id'
```

On affected GitLab servers, the output will look like this:

```
uid=1001(git) gid=1001(git) groups=1001(git)
```

If you see `Not allowed command` instead, your GitLab server is not affected by
this vulnerability.

## Workarounds

First try updating Bash on your system.

```
# Debian/Ubuntu
sudo apt-get install bash

# Centos
yum install bash
```

Test if the vulnerability is gone with the command listed above under
'Detection'.

If this does not fix the vulnerability you can change the shell of the `git`
user to `csh`. Dash, which is installed on Debian/Ubuntu by default, is also an
option.

```
# Debian/Ubuntu
sudo apt-get install csh

# Centos
sudo yum install csh
```

If you are using omnibus-gitlab, add the following line to
`/etc/gitlab/gitlab.rb` and run `sudo gitlab-ctl reconfigure`:

```
user['shell'] = '/bin/csh'
```

If you are using an installation from source you can change the shell for the
git user with the following command:

```
sudo chsh -s /bin/csh git
```

Now test if you are no longer vulnerable with the command listed above under
'Detection'.

If changing the shell of the Git user is not an option for some reason you can
also defend against this vulnerability by adding `git` to the `DenyUsers` in
`/etc/ssh/sshd_config` and restarting SSH. Note that this will disable Git
push/pull access via SSH to your GitLab server.

```
DenyUsers git
```

Add blog post about gitlab-shell and CVE-2014-6271
Add blog post about gitlab-shell and CVE-2014-6271
