Vulnerability & Exploit Database

Back to search

Malicious Git HTTP Server For CVE-2017-1000117

This module exploits CVE-2017-1000117, which affects Git version 2.7.5 and lower. A submodule of the form 'ssh://' can be passed parameters from the username incorrectly. This can be used to inject commands to the operating system when the submodule is cloned. This module creates a fake git repository which contains a submodule containing the vulnerability. The vulnerability is triggered when the submodules are initialised.

Free Metasploit Download

Get your copy of the world's leading penetration testing tool

 Download Now

Module Name




  • Automatic


  • unix


  • cmd



Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/git_submodule_command_exec msf exploit(git_submodule_command_exec) > show targets ...targets... msf exploit(git_submodule_command_exec) > set TARGET <target-id> msf exploit(git_submodule_command_exec) > show options and set options... msf exploit(git_submodule_command_exec) > exploit

Related Vulnerabilities