Savane command injection in GNU Savannah allowed RCE, Bash maintainer impersonation and root access; FSF fixed 26 flaws

Linha do tempo

1. hacktron.ai ↗ · pub. 29/10/2026 21:00 · coletado 05/11 19:00

   Researchers find RCE chain in GNU Savannah/Savane that could have backdoored Bash, Coreutils repos

   ler a análise desta fonte ocultar

   Security researchers at Hacktron used an AI-assisted audit to find a command injection flaw in Savane, the PHP application that runs GNU Savannah, the forge hosting Bash, Coreutils, and hundreds of other GNU projects. By registering an account with an email address containing shell metacharacters (backticks and ${IFS}) and triggering Savane's "Test GPG keys" feature, the researchers achieved remote code execution as the web server user. From there they escalated to superuser on the Savane application, impersonated Bash maintainer Chet Ramey via Savannah's "Become this user" feature, and confirmed they could add an SSH key granting push access to the upstream Bash Git repository, stopping short of actually modifying it. The team reported the issue to the FSF on May 11, 2026, then ran a broader audit that surfaced 26 confirmed vulnerabilities in total, all of which the FSF has since fixed and documented in a public incident report published August 7, 2026.

   Technical Details

   The root cause was in Savane's email validator (frontend/php/include/account.php:275), which accepts dot-atom email addresses containing characters such as backticks, $, {}, /, and | because they are technically permitted in the local part of an address under the relevant RFC. The "Test GPG keys" feature (frontend/php/include/gpg.php) appends the account's email address as plain text into a shell command string passed to proc_open(), which PHP executes through /bin/sh, letting backticked shell commands run before gpg itself executes. ${IFS} was used in place of a space because the validator rejects literal spaces. Exploitation required only registering or changing an account's email to the crafted payload and clicking "Test GPG keys." Once on the backend as the web server user, the researchers read database credentials from Savane's configuration, set the superuser flag on their own account, and used the "Become this user" superuser feature to act as Bash's maintainer. Privilege escalation to root was achieved via a public exploit for GameOver(lay), two 2023 OverlayFS kernel bugs (CVE-2023-2640 and CVE-2023-32629); Savannah ran Trisquel GNU/Linux 11 on a 5.15 LTS kernel that Canonical had not patched for these bugs until USN-8255-1 on May 7, 2026, four days before the report. With root, the researchers found SSH credentials granting access to a separate GNU backup host. The FSF traced the vulnerable code path back to the Savane 3.17-c369 release of March 7, 2026, affecting both savannah.gnu.org and savannah.nongnu.org for roughly two months. A follow-on audit of the Savane codebase, which descends from 2001-era SourceForge code, produced 33 findings, of which 26 were confirmed (2 critical, 6 high, 16 medium, 2 low), including authorization bypasses in site-wide admin group configuration, mailing list and tracker notification tampering, private file access via an unchecked file_uid parameter, session hijacking via URL-embedded SSO tokens, non-expiring password reset hashes, and stored XSS in the real name field.

   Remediation

   The FSF treated the finding as a full compromise: it installed the patched kernel, audited access controls, databases and logs, fixed the Savane vulnerabilities (the authorization bugs through a broader refactor rather than individual patches), warned the operator of the other public Savane instance, and published both a statement and a full incident report along with the Savane patches.

2. hacktron.ai ↗ · pub. 29/10/2026 21:00 · coletado 29/10 19:00 primeiro registro

   Savane RCE on GNU Savannah via malicious email address allowed Bash maintainer impersonation and root access

   ler a análise desta fonte ocultar

   Researchers at Hacktron disclosed a command injection flaw in Savane, the PHP forge software behind GNU Savannah (savannah.gnu.org and savannah.nongnu.org). Any registered user could set an email address containing shell metacharacters, which was later passed unsanitised to a shell command by the "Test GPG keys" feature. Hacktron chained this into web server RCE, superuser status, impersonation of Bash maintainer Chet Ramey, and root access through an unpatched kernel, then reached a GNU backup host. The team confirmed it could add an SSH key granting push access to the upstream Bash repository, but did not do so or touch the repository. They reported it to the FSF on May 11, 2026, followed by 25 more findings (26 in total). The FSF treated the incident as a full compromise and fixed the issues. The article does not report in-the-wild exploitation.

   Technical Details

   • The email validator (frontend/php/include/account.php:275) accepts dot-atom addresses with backticks, $, {}, / and |. Example payload: 1a`touch${IFS}/tmp/savane-rce-proof`@attacker.example. ${IFS} replaces the spaces the validator rejects.
   • The address can be set at registration or through the email-change flow (frontend/php/my/admin/change.php:271).
   • In frontend/php/include/gpg.php, test_listing() appends the account email to the gpg options. utils_run_proc() passes the string to proc_open(), which runs it through /bin/sh, so the backtick command executes as the web server user.
   • The vulnerable path was introduced in Savane release 3.17-c369 (March 7, 2026), giving an exposure window of about two months.
   • The web server user could read the Savane config containing database credentials. The researchers set the superuser flag on their own account and used the "Become this user" feature to impersonate Chet Ramey (Bash maintainer). The SSH key page that controls Git push access to bash.git accepted edits.
   • Privilege escalation to root used GameOver(lay) (CVE-2023-2640 and CVE-2023-32629) on the unpatched linux-libre 5.15 kernel of Trisquel GNU/Linux 11. The fix for that kernel (USN-8255-1) shipped on May 7, 2026, four days before the report. A public exploit worked on the first attempt.
   • As root, the researchers found a key that gave SSH access to a GNU backup host as the gnubackup user.
   • Further Hacktron pentesting produced 33 findings. After discarding 7 false positives, 26 were reported (2 critical, 6 high, 16 medium, 2 low).

   Remediation

   • The FSF patched the kernel, audited access controls, databases and logs, and warned the operator of the other public Savane instance.
   • The authorization bugs were fixed through a refactor rather than individual patches.
   • Operators of Savane instances should update to a fixed release and apply current kernel updates. Maintainers should review SSH keys on their Savannah accounts.