CVE-2017-9800
What it is
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
At a glance
- Exploitability
- Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 18.9% chance of exploitation in the next 30 days (EPSS). Higher than most.
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 18.9% in the next 30 days (EPSS).
- Severity: 9.8 CRITICAL (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 18.9% · EPSS, next 30 days
- Weakness
- CWE-20 · Improper input validation
- Record status
- Modified
Affected
- Apache Subversion ≤ 1.8.18
- Apache Subversion 1.9.0
- Apache Subversion 1.9.1
- Apache Subversion 1.9.2
- Apache Subversion 1.9.3
- Apache Subversion 1.9.4
- Apache Subversion 1.9.5
- Apache Subversion 1.9.6
Attack profile CVSS 3.0 · 9.8
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2017-9800.md and follow it. Check whether this project is affected by CVE-2017-9800. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
- https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
References
- http://packetstormsecurity.com/files/143722/Apache-Subversion-Arbitrary-Code-Execution.html
- http://www.debian.org/security/2017/dsa-3932
- http://www.securityfocus.com/archive/1/540999/100/0/threaded
- http://www.securityfocus.com/bid/100259
- http://www.securitytracker.com/id/1039127
- https://access.redhat.com/errata/RHSA-2017:2480
- https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2017-08-11-933099891.html
- https://lists.apache.org/thread.html/cb607dc2f13bab9769147759ddccb14a4f9d8e5cdcad5e99c0d03b63%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/d8cf53affd700dfce90bad4968fb8b1dfb69cf7c443052c70398ff76%40%3Ccommits.subversion.apache.org%3E
- https://security.gentoo.org/glsa/201709-09
- https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
- https://support.apple.com/HT208103
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://packetstormsecurity.com/files/143722/Apache-Subversion-Arbitrary-Code-Execution.html
- http://www.debian.org/security/2017/dsa-3932
- http://www.securityfocus.com/archive/1/540999/100/0/threaded
- http://www.securityfocus.com/bid/100259
- http://www.securitytracker.com/id/1039127
- https://access.redhat.com/errata/RHSA-2017:2480
- https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2017-08-11-933099891.html
- https://lists.apache.org/thread.html/cb607dc2f13bab9769147759ddccb14a4f9d8e5cdcad5e99c0d03b63%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/d8cf53affd700dfce90bad4968fb8b1dfb69cf7c443052c70398ff76%40%3Ccommits.subversion.apache.org%3E
- https://security.gentoo.org/glsa/201709-09
- https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
- https://support.apple.com/HT208103