Arbitrary command execution in Gerapy

Vulnerability

In Gerapy versions prior to 0.9.9, the project_clone endpoint in views.py accepts an address parameter from an authenticated POST request. This parameter is appended with .git if necessary and inserted directly into a git clone command string without sanitization, leading to command injection [2]. The affected code is reachable only by authenticated users [2].

Exploitation

An authenticated attacker can send a POST request to the project_clone endpoint with a crafted address value. For example, supplying /dev/null || malicious code # causes the shell to interpret the injected content as additional commands after the intended git operation [2]. The attacker does not require any special privileges beyond a valid session [2].

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands with the privileges of the Gerapy server process. This can lead to full compromise of the crawler management system, including data exfiltration, installation of backdoors, or lateral movement within the network [1][2].

Mitigation

The vulnerability is fixed in Gerapy version 0.9.9 [1][2]. Users should upgrade to this version immediately. There are no known workarounds for earlier releases [1].