# Mercurial can be tricked into granting authorized users access to the Python debugger

Custom hg-ssh wrappers failing to validate the repo argument let an authorized user pass --debugger to hg serve --stdio, dropping into a Pdb shell for arbitrary Python execution.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: claudijd
- Disclosed: 2017-07-12
- CVE: CVE-2017-9462
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/222020
- Library page: https://bugbountylibrary.com/r/h1%3A222020
- Tags: area:cloud domain:infra impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:linux technique:source-review vuln:command-injection vuln:rce

**Target:** hg serve --stdio via customized hg-ssh wrapper
**Root cause:** Customized hg-ssh wrappers that don't validate the repo attribute pass attacker-controlled arguments to the internal hg binary; the --debugger flag causes hg to drop into a Pdb shell.
**Steps:**
1. Attacker has authorized SSH access to a Mercurial server using a customized hg-ssh wrapper.
2. Supply `--debugger` as the repo attribute value through the wrapper.
3. Wrapper passes it unvalidated to `hg serve --stdio`, which enters a Pdb shell.
4. Execute arbitrary Python code in the Pdb shell.
**How found:** Noticed that many services write or heavily customize their own hg-ssh wrappers, and hypothesized that a wrapper not explicitly validating the repo attribute would forward attacker-controlled arguments to the internal hg binary.
**Exploitation:** An authorized user supplies `--debugger` as the repo argument to a customized hg-ssh wrapper; the unvalidated value reaches `hg serve --stdio`, which opens a Pdb debugger shell, giving arbitrary Python code execution on the server. A Metasploit module was produced.
**Insight:** When a project ships a reference wrapper (hg-ssh) that downstream operators routinely fork and customize, audit the argument-passing boundary: any unvalidated positional value reaching the underlying binary can smuggle flags like --debugger that open interactive shells.