GitList Unescaped Git Commit Metadata Causes XML Parse Failure and HTTP 500

Vulnerability Summary: Unescaped Git Commit Metadata in GitList Causes XML Parsing Failure (HTTP 500) Vulnerability Overview Issue: GitList parses XML-style commit records from Git's pretty-format output, but certain commit metadata fields (such as author name, email, and title) are not escaped before being inserted into the XML. Trigger Condition: In a repository controlled by an attacker, if the commit metadata contains unescaped (or other XML special characters like or ), it will cause parsing to fail, resulting in the relevant public routes returning HTTP 500. Root Cause: - uses to generate XML-style output. - During parsing, it directly executes without XML-escaping the field values. - Attack chain: Attacker controls metadata → Embeds unescaped characters → Parsing exception occurs → Route returns 500. Affected Scope Affected Routes (routes that parse commit metadata): - - - Impact: The aforementioned routes return HTTP 500 when encountering commit metadata containing unescaped , preventing the pages from rendering correctly. Reproduction Steps (Key Commands) Place the repository in a directory scanned by GitList and access the aforementioned routes to trigger the 500 error. PoC Code Example Output: Reason for parsing failure: The in the string is not escaped, causing a parsing exception. Remediation Fix Commit: commit (commit ) — "Refactored commit format parsing. Fixes klausssilveira#948". Fix Approach: Refactor the commit format parsing logic and apply XML escaping to commit metadata fields (or switch to a safe parsing method) to prevent unescaped characters from causing parsing failures. Status: The issue has been marked as completed (closed).

Goal Reached Thanks to every supporter — we hit 100%!

GitList Unescaped Git Commit Metadata Causes XML Parse Failure and HTTP 500

More from this source