# Command injection on Phabricator instance with an evil hg branch name

A Mercurial branch named `--config=hooks.pre-log=wget` was passed unquoted into Phabricator's `hg log` command, executing arbitrary commands when viewing branch history.

- Payout: hidden
- Severity: critical
- Program: Phabricator
- Found by: criticalonly
- Disclosed: 2017-11-11
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/288704
- Library page: https://bugbountylibrary.com/r/h1%3A288704
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:php technique:source-review vuln:command-injection vuln:rce

**Target:** Mercurial repository history page in Phabricator Diffusion
**Root cause:** Phabricator passes the attacker-controlled branch name directly into the `hg log` command line without sanitization; a branch starting with `--config=` is parsed by Mercurial as an option, letting the attacker define a `hooks.pre-log` command that runs before the log operation.
**Steps:**
1. Monitor a remote Mercurial repo with Phabricator.
2. On the remote, create a branch named `--config=hooks.pre-log=wget`.
3. Let Phabricator pull/update the remote repo.
4. Visit `http://instanceip/source/hgclone/history/--config%253Dhooks.pre-log%253Dwget/`.
5. The `hg log` invocation includes `-b '--config=hooks.pre-log=wget'`, Mercurial treats it as a config option, and the `pre-log` hook executes `wget`.
**How found:** Noticed that branch names flow into the `hg log` command line and that Mercurial accepts `--config=` options anywhere, allowing a branch name to redefine a hook that fires before the log command.
**Exploitation:** Attacker controls a monitored Mercurial repo, creates a maliciously named branch, waits for Phabricator to sync, then lures/waits for a user to open that branch's history page; the injected `--config` defines a hook that runs an arbitrary command on the Phabricator host.
**Insight:** When a VCS CLI is invoked with user-controlled refs/branch names, test whether the tool accepts `--config=`/`-c` options mid-command; defining a `hooks.pre-*` hook turns a benign-looking ref into command execution.