CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-24765 – Uncontrolled search for the Git directory in Git for Windows
https://notcve.org/view.php?id=CVE-2022-24765
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. • http://seclists.org/fulldisclosure/2022/May/31 http://www.openwall.com/lists/oss-security/2022/04/12/7 https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2 https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-24066 – Command Injection
https://notcve.org/view.php?id=CVE-2022-24066
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. El paquete simple-git versiones anteriores a 3.5.0, es vulnerable a una inyección de comandos debido a una corrección incompleta de [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) que sólo parchea contra el vector de ataque git fetch. Un uso similar de la función --upload-pack de git también es compatible con git clone, que la corrección anterior no cubría • https://gist.github.com/lirantal/a930d902294b833514e821102316426b https://github.com/steveukx/git-js/commit/2040de601c894363050fef9f28af367b169a56c5 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820 https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-23632 – Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2021-23632
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require("git").Git; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. • https://snyk.io/vuln/SNYK-JS-GIT-1568518 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24433 – Command Injection
https://notcve.org/view.php?id=CVE-2022-24433
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution. El paquete simple-git versiones anteriores a 3.3.0, es vulnerable a una Inyección de Comandos por medio de una inyección de argumentos. Cuando es llamado a la función .fetch(remote, branch, handlerFn), los parámetros remote y branch son pasados al subcomando git fetch. • https://github.com/steveukx/git-js/pull/767 https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2421245 https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2022-24975
https://notcve.org/view.php?id=CVE-2022-24975
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk. La documentación --mirror para Git versiones hasta 2.35.1, no menciona la disponibilidad del contenido eliminado, también se conoce como el problema "GitBleed". Esto podría presentar un riesgo de seguridad si los procesos de auditoría de divulgación de información dependen de una operación de clonación sin la opción --mirror • https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191 https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed https://www.aquasec.com/blog/undetected-hard-code-secrets-expose-corporations https://lore.kernel.org/git/xmqq4k14qe9g.fsf%40gitster.g • CWE-668: Exposure of Resource to Wrong Sphere •