EN PT-BR
← Voltar ao feed
high technology open source software

Savane RCE on GNU Savannah via malicious email address allowed Bash maintainer impersonation and root access

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 21:00 · coletado há 3 dias

Researchers at Hacktron disclosed a command injection flaw in Savane, the PHP forge software behind GNU Savannah (savannah.gnu.org and savannah.nongnu.org). Any registered user could set an email address containing shell metacharacters, which was later passed unsanitised to a shell command by the "Test GPG keys" feature. Hacktron chained this into web server RCE, superuser status, impersonation of Bash maintainer Chet Ramey, and root access through an unpatched kernel, then reached a GNU backup host. The team confirmed it could add an SSH key granting push access to the upstream Bash repository, but did not do so or touch the repository. They reported it to the FSF on May 11, 2026, followed by 25 more findings (26 in total). The FSF treated the incident as a full compromise and fixed the issues. The article does not report in-the-wild exploitation.

Entenda a falha

A vulnerabilidade

The most severe flaw is a command injection in Savane 3.17-c369, the PHP forge software behind GNU Savannah (savannah.gnu.org and savannah.nongnu.org). Any registered user can set an email address containing shell metacharacters, then use the "Test GPG keys" feature to run commands as the web server user. No CVE is listed for it. The FSF traced it to the 3.17-c369 release of March 7, 2026, so the window was about two months. Hacktron chained it with CVE-2023-2640 and CVE-2023-32629 (GameOver(lay), OverlayFS local privilege escalations) on the linux-libre 5.15 kernel of Trisquel GNU/Linux 11 to get root. Canonical fixed that kernel in USN-8255-1 on May 7, 2026. The articles do not name a fixed Savane version. Hacktron reported 26 Savane bugs in total, and the FSF fixed them.

Como funciona

At registration or in the email-change flow, Savane's validator accepts addresses with characters such as backticks, $, braces, slash and pipe, because the RFC allows them in the local part. Later, a logged-in user opens the GPG key page and clicks "Test GPG keys". One check lists key fingerprints for the account's email, so test_listing() appends that address to the gpg options. The full string goes to proc_open() as a string, so PHP runs it through /bin/sh. The shell expands the backtick content before gpg starts, and the commands run on the server. The validator rejects spaces, and the shell's IFS variable stands in for them. From there the web server user could read the Savane configuration with the database credentials, flag its own account as superuser, and use the "Become this user" feature to act as any account.

Por que é vulnerável

The root cause is untrusted data placed into a shell command line without escaping: the email is concatenated as plain text into a command string that runs through a shell. The email validator was also too permissive for a value later used in a command, since it accepted shell-significant characters that the RFC permits. The articles do not say why this went unnoticed, beyond noting that Savannah is run by a few volunteers and FSF staff and that Savane descends from the 2001 SourceForge code. The exact fix for the injection is not described; the authorization bugs were fixed through a refactor. The root step worked because the kernel still lacked the fix for the 2023 OverlayFS bugs.

Onde está

The email validator at frontend/php/include/account.php:275, the email-change flow at frontend/php/my/admin/change.php:271, the GPG test page at /my/admin/change.php?item=gpgkey, and the functions test_gpg_command and test_listing in frontend/php/include/gpg.php, which pass the command to utils_run_proc() and then proc_open().

Como foi descoberta

Hacktron, a security firm that uses AI to accelerate research, found the bug by pointing its tooling at the Savane source and auditing it. It reported the issue to the FSF on May 11, 2026, and Savannah administrator Corwin Brust replied the same night. Hacktron then kept running its pentest on the Savane code, which produced 33 findings; it discarded 7 as false positives and sent the other 26 (2 critical, 6 high, 16 medium, 2 low) with file paths, line numbers and reproduction steps. The FSF treated the case as a full compromise: it patched the kernel, audited access controls, databases and logs, warned the operator of the other public Savane instance, and published an incident report. The articles do not report exploitation by attackers.

PoC pública

Hacktron's write-up documents the full chain it ran against Savannah: command execution via the email field (it shows the payload shape and the vulnerable code), database credentials read from the Savane configuration, its own account made superuser, impersonation of Bash's maintainer, and root via OverlayFS, then access to a GNU backup host. It stopped before adding an SSH key or touching any repository. No standalone exploit for the Savane bug is published. For the kernel step it says a public GameOver(lay) exploit worked on the first try, so unpatched 5.15 kernels are easy to take over. Treat Savane and kernel patching as urgent.

Publicada em: www.hacktron.ai/blog/hacking-gnu-savannah ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 15:23.

Detalhes técnicos

  • The email validator (frontend/php/include/account.php:275) accepts dot-atom addresses with backticks, $, {}, / and |. Example payload: 1a`touch${IFS}/tmp/savane-rce-proof`@attacker.example. ${IFS} replaces the spaces the validator rejects.
  • The address can be set at registration or through the email-change flow (frontend/php/my/admin/change.php:271).
  • In frontend/php/include/gpg.php, test_listing() appends the account email to the gpg options. utils_run_proc() passes the string to proc_open(), which runs it through /bin/sh, so the backtick command executes as the web server user.
  • The vulnerable path was introduced in Savane release 3.17-c369 (March 7, 2026), giving an exposure window of about two months.
  • The web server user could read the Savane config containing database credentials. The researchers set the superuser flag on their own account and used the "Become this user" feature to impersonate Chet Ramey (Bash maintainer). The SSH key page that controls Git push access to bash.git accepted edits.
  • Privilege escalation to root used GameOver(lay) (CVE-2023-2640 and CVE-2023-32629) on the unpatched linux-libre 5.15 kernel of Trisquel GNU/Linux 11. The fix for that kernel (USN-8255-1) shipped on May 7, 2026, four days before the report. A public exploit worked on the first attempt.
  • As root, the researchers found a key that gave SSH access to a GNU backup host as the gnubackup user.
  • Further Hacktron pentesting produced 33 findings. After discarding 7 false positives, 26 were reported (2 critical, 6 high, 16 medium, 2 low).

Remediação

  • The FSF patched the kernel, audited access controls, databases and logs, and warned the operator of the other public Savane instance.
  • The authorization bugs were fixed through a refactor rather than individual patches.
  • Operators of Savane instances should update to a fixed release and apply current kernel updates. Maintainers should review SSH keys on their Savannah accounts.

Linha do tempo

  1. hacktron.ai ↗ · pub. 29/10/2026 21:00 · coletado 29/10 19:00 primeiro registro

    Savane RCE on GNU Savannah via malicious email address allowed Bash maintainer impersonation and root access

    ler a análise desta fonte

    Researchers at Hacktron disclosed a command injection flaw in Savane, the PHP forge software behind GNU Savannah (savannah.gnu.org and savannah.nongnu.org). Any registered user could set an email address containing shell metacharacters, which was later passed unsanitised to a shell command by the "Test GPG keys" feature. Hacktron chained this into web server RCE, superuser status, impersonation of Bash maintainer Chet Ramey, and root access through an unpatched kernel, then reached a GNU backup host. The team confirmed it could add an SSH key granting push access to the upstream Bash repository, but did not do so or touch the repository. They reported it to the FSF on May 11, 2026, followed by 25 more findings (26 in total). The FSF treated the incident as a full compromise and fixed the issues. The article does not report in-the-wild exploitation.

    Technical Details

    • The email validator (frontend/php/include/account.php:275) accepts dot-atom addresses with backticks, $, {}, / and |. Example payload: 1a`touch${IFS}/tmp/savane-rce-proof`@attacker.example. ${IFS} replaces the spaces the validator rejects.
    • The address can be set at registration or through the email-change flow (frontend/php/my/admin/change.php:271).
    • In frontend/php/include/gpg.php, test_listing() appends the account email to the gpg options. utils_run_proc() passes the string to proc_open(), which runs it through /bin/sh, so the backtick command executes as the web server user.
    • The vulnerable path was introduced in Savane release 3.17-c369 (March 7, 2026), giving an exposure window of about two months.
    • The web server user could read the Savane config containing database credentials. The researchers set the superuser flag on their own account and used the "Become this user" feature to impersonate Chet Ramey (Bash maintainer). The SSH key page that controls Git push access to bash.git accepted edits.
    • Privilege escalation to root used GameOver(lay) (CVE-2023-2640 and CVE-2023-32629) on the unpatched linux-libre 5.15 kernel of Trisquel GNU/Linux 11. The fix for that kernel (USN-8255-1) shipped on May 7, 2026, four days before the report. A public exploit worked on the first attempt.
    • As root, the researchers found a key that gave SSH access to a GNU backup host as the gnubackup user.
    • Further Hacktron pentesting produced 33 findings. After discarding 7 false positives, 26 were reported (2 critical, 6 high, 16 medium, 2 low).

    Remediation

    • The FSF patched the kernel, audited access controls, databases and logs, and warned the operator of the other public Savane instance.
    • The authorization bugs were fixed through a refactor rather than individual patches.
    • Operators of Savane instances should update to a fixed release and apply current kernel updates. Maintainers should review SSH keys on their Savannah accounts.