CVE-2024-47516

What it actually does

Argument injection into Git commands executed during repository history retrieval allows an unauthenticated remote attacker to execute arbitrary operating-system commands on the Pagure server.

Why it matters to the business

Successful exploitation grants full control of the Pagure instance, enabling theft or alteration of source code, supply-chain attacks against downstream projects, and potential lateral movement into connected build or deployment systems.

How an attack unfolds

An attacker crafts a malicious repository name or reference that is passed unsanitized to a Git command used to fetch history; the injected arguments cause Git to execute attacker-controlled commands, resulting in remote code execution on the server.

How to fix it

Upgrade affected packages to the versions that contain the fix: openstack-packstack, openstack-packstack-doc, openstack-packstack-puppet, and openstack-puppet-modules all updated to 0:2014.2-0.20.dev1467.g70c9655.el7ost or 0:2014.2.13-2.el7ost as appropriate for each package. Apply the updates via the distribution package manager and restart Pagure services.

How to confirm the fix worked

After patching, confirm the installed package versions match the fixed releases listed above, then exercise the repository-history retrieval functionality with previously malicious inputs to verify command injection is no longer possible.

Typical attack path

1. Identify a reachable Pagure instance and locate a repository-history endpoint
2. Craft a request containing shell metacharacters or Git argument sequences that survive input validation
3. Submit the request; the server invokes Git with the attacker-controlled arguments
4. Git executes the injected commands, establishing a reverse shell or dropping a payload
5. Attacker pivots from the compromised instance to source-code repositories or CI/CD pipelines

How to detect it

Search web-server access logs for unusually long or specially formatted repository references on history-retrieval endpoints; inspect system process listings and audit logs for unexpected Git child processes or shell invocations originating from the Pagure service account.

What your security team should do

• Immediately schedule the listed package upgrades on all Pagure deployments
• Review network exposure of Pagure instances and restrict unauthenticated access where feasible
• Monitor package-update channels for any additional Pagure-related fixes
• Add the repository-history endpoints to web-application firewall rules as a temporary control