Atlassian SourceTree CVE-2017-8768 Command Injection Vulnerability

Bugtraq ID:	98329
Class:	Unknown
CVE:	CVE-2017-8768
Remote:	Yes
Local:	No
Published:	May 04 2017 12:00AM
Updated:	May 23 2017 04:24PM
Credit:	Yu Hong
Vulnerable:	Atlassian SourceTree 2.5 Atlassian SourceTree 1.4 Atlassian SourceTree 2.5C Atlassian SourceTree 2.0.20.0 Atlassian SourceTree 0.8.4b
Not Vulnerable:	Atlassian SourceTree 2.5.1 Atlassian SourceTree 2.0.20.1

Atlassian SourceTree CVE-2017-8768 Command Injection Vulnerability

Atlassian SourceTree is prone to a remote command-injection vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts may cause a denial-of-service condition.

The following products are affected:

SourceTree for Mac 1.4.0 and later.
SourceTree for Windows 0.8.4b and later.

Atlassian SourceTree CVE-2017-8768 Command Injection Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Atlassian SourceTree CVE-2017-8768 Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Atlassian SourceTree CVE-2017-8768 Command Injection Vulnerability

References:

• [oss-security]Sourcetree arbitrary command execution (Seclists.org)
  
• Atlassian Homepage (Atlassian)
  
• SourceTree Homepage (Atlassian)
  
• SourceTree Security Advisory 2017-05-10 (Atlassian)