# Git flag injection leads to arbitrary file write

Unvalidated commit param in Phabricator's diffusion gitrawdiffquery API allows git flag injection via --output, writing arbitrary files and potentially achieving RCE.

- Payout: hidden
- Severity: high
- Program: Phabricator
- Found by: crownpeanut
- Disclosed: 2021-07-25
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1070247
- Library page: https://bugbountylibrary.com/r/h1%3A1070247
- Tags: area:web domain:web impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:command-injection vuln:path-traversal

**Target:** Diffusion Conduit API (diffusion.internal.gitrawdiffquery)
**Root cause:** The commit parameter is passed unsanitized into a git log command line, so a value beginning with --output= is interpreted as a git flag rather than a revision, redirecting git's output to an attacker-chosen path.
**Steps:**
1. Login and generate an API token
2. Create a repo and push several commits
3. Send `curl http://dev.localhost/api/diffusion.internal.gitrawdiffquery -d api.token=api-token -d commit=--output%3D/tmp/qqq -d repository=R2`
4. Observe `/tmp/qqq` created containing git log output
5. To escalate, target a writable path like the repo's `pre-receive` hook and inject a commit filename such as `; ls` so the written hook content executes on next push
**How found:** Recognized that the commit parameter flows directly into a shell git log invocation, and that git accepts `--output=` as a flag, so a value starting with `--` is treated as an option rather than a revision.
**Exploitation:** Attacker with an API token supplies `commit=--output=<path>` to redirect git log output into an arbitrary file. If the repo directory is writable by the web user, overwriting the `pre-receive` hook with attacker-controlled content (derived from a crafted commit filename) yields code execution when the hook next runs.
**Escalation:** Chaining arbitrary file write into overwriting the git `pre-receive` hook to achieve RCE on the Phabricator server.
**Insight:** When a user-controlled value is placed into a git/hg command line, test whether it can be interpreted as a flag (e.g. `--output=`, `--upload-pack=`, `-c`); git's `--output` gives arbitrary file write, and targeting hook files like `pre-receive` converts it to RCE.