CVE request: remote code execution vulnerability in gollum < 4.0.1

[Dawa Ometto <d.l.a.ometto () uu nl>]

Hi,

I just released a fix for a remote code execution vulnerability in
gollum [1]. The vulnerable code was in the gollum-grit_adapter [2] ruby
gem dependency as of gollum v3.1.0, but the exploitable code was also
present before that version, in the gollum-lib [3] gem dependency (code
was abstracted from gollum-lib to the new dependency).

Type of vulnerability: remote code execution
Attack outcome: run arbitrary commands, shell access
Vulnerable versions: gollum < 3.1.1, gollum-lib < 4.0.1,
gollum-grit_adapter < 0.1.1
Fix: `gem update gollum` will update the dependencies.
Link to vulnerability/fix diff:
https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7
Link to project issue: https://github.com/gollum/gollum/issues/913

Description: The bug exploits the fact that gollum uses the grit gem for
git repository access, which makes command-line calls to `git grep` to
search files. `git grep` has an `-O` or `--open-files-in-pager` option
which can spawn an arbitrary process (to act as pager). In vulnerable
versions of gollum, searching for the string `-O<arbitrary command>` or
`--open-files-in-pager <arbritary command>` in the wiki's search field
will execute an arbitrary shell command. However, this will only work if
the string "master" (or more precisely, the name of the git branch that
gollum is using) is found in one of the wiki's files: "master" is then
interpreted as the search query, `-O<arbitary code>` as a command line
option to `git grep`.

The fix in the `gollum-grit_adapter` gem v.0.1.1 shell-escapes the
user's query and removes any -O or --open-file-in-pager option from it.

[1] https://github.com/gollum/gollum, https://rubygems.org/gems/gollum
[2] https://github.com/gollum/grit_adapter
[3] https://github.com/gollum/gollum-lib