CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 38CVE-2024-32002 – Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-32002
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. • https://github.com/amalmurali47/git_rce https://github.com/amalmurali47/hook https://github.com/bonnettheo/CVE-2024-32002 https://github.com/WOOOOONG/CVE-2024-32002 https://github.com/WOOOOONG/hook https://github.com/markuta/hooky https://github.com/markuta/CVE-2024-32002 https://github.com/bfengj/CVE-2024-32002-Exploit https://github.com/bfengj/CVE-2024-32002-hook https://github.com/tiyeume25112004/CVE-2024-32002 https://github.com/charlesgargasson/CVE-2024-32002 https:& • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 2CVE-2023-29007 – Arbitrary configuration injection via `git submodule deinit`
https://notcve.org/view.php?id=CVE-2023-29007
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. • https://github.com/ethiack/CVE-2023-29007 https://github.com/omespino/CVE-2023-29007 https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4 https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7 https://lists.fedoraproject.org/archives/list/package-announce@lists.fed • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2023-25652 – "git apply --reject" partially-controlled arbitrary file write
https://notcve.org/view.php?id=CVE-2023-25652
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. • http://www.openwall.com/lists/oss-security/2023/04/25/2 https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902 https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7 https://lists.fe • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 1CVE-2023-23946 – Git's `git apply` overwriting paths outside the working tree
https://notcve.org/view.php?id=CVE-2023-23946
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link. A vulnerability was found in Git. • https://github.com/bruno-1337/CVE-2023-23946-POC https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh https://security.gentoo.org/glsa/202312-15 https://access.redhat.com/security/cve/CVE-2023-23946 https://bugzilla.redhat.com/show_bug.cgi?id=2168161 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 0CVE-2023-22490 – Git vulnerable to local clone-based data exfiltration with non-local transports
https://notcve.org/view.php?id=CVE-2023-22490
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. • https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85 https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q https://security.gentoo.org/glsa/202312-15 https://access.redhat.com/security/cve/CVE-2023-22490 https://bugzilla.redhat.com/show_bug.cgi?id=2168160 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak') •