CVE-2018-11235
git: arbitrary code execution when recursively cloning a malicious repository
Severity Score
7.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
14
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
En Git, en versiones anteriores a la 2.13.7, versiones 2.14.x anteriores a la 2.14.4, versiones 2.15.x anteriores a la 2.15.2, versiones 2.16.x anteriores a la 2.16.4 y versiones 2.17.x anteriores a la 2.17.1, puede ocurrir una ejecución remota de código. Con un archivo .gitmodules manipulado, un proyecto malicioso puede ejecutar un script arbitrario en una máquina que ejecuta "git clone --recurse-submodules" debido a que se obtienen "nombres" de subdominios de este archivo y luego se anexa a $GIT_DIR/modules, lo que conduce a un salto de directorio con "../" en un nombre. Finalmente, se ejecutan hooks post-checkout de un submódulo, omitiendo el diseño planeado en el que no se obtienen hooks de un servidor remoto.
Git versions prior to 2.17.1 suffer from a code execution vulnerability.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-05-18 CVE Reserved
- 2018-05-30 CVE Published
- 2018-05-31 First Exploit
- 2024-08-05 CVE Updated
- 2024-10-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (26)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/104345 | Third Party Advisory | |
| http://www.securitytracker.com/id/1040991 | Third Party Advisory | |
| https://marc.info/?l=git&m=152761328506724&w=2 | Release Notes |
| URL | Date | SRC |
|---|---|---|
| https://github.com/Rogdham/CVE-2018-11235 | 2018-06-03 | |
| https://github.com/CHYbeta/CVE-2018-11235-DEMO | 2018-06-07 | |
| https://github.com/qweraqq/CVE-2018-11235-Git-Submodule-CE | 2019-04-09 | |
| https://github.com/j4k0m/CVE-2018-11235 | 2021-09-22 | |
| https://github.com/knqyf263/CVE-2018-11235 | 2018-11-23 | |
| https://github.com/AnonymKing/CVE-2018-11235 | 2019-06-22 | |
| https://github.com/ygouzerh/CVE-2018-11235 | 2019-05-14 | |
| https://github.com/vmotos/CVE-2018-11235 | 2018-05-31 | |
| https://github.com/xElkomy/CVE-2018-11235 | 2020-07-12 | |
| https://github.com/jhswartz/CVE-2018-11235 | 2018-06-04 | |
| https://github.com/nthuong95/CVE-2018-11235 | 2020-03-05 | |
| https://github.com/Kiss-sh0t/CVE-2018-11235-poc | 2018-06-06 | |
| https://github.com/jongmartinez/CVE-2018-11235-PoC | 2020-10-25 | |
| https://www.exploit-db.com/exploits/44822 | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability | 2020-05-02 |
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html | 2020-05-02 | |
| https://access.redhat.com/errata/RHSA-2018:1957 | 2020-05-02 | |
| https://access.redhat.com/errata/RHSA-2018:2147 | 2020-05-02 | |
| https://security.gentoo.org/glsa/201805-13 | 2020-05-02 | |
| https://usn.ubuntu.com/3671-1 | 2020-05-02 | |
| https://www.debian.org/security/2018/dsa-4212 | 2020-05-02 | |
| https://access.redhat.com/security/cve/CVE-2018-11235 | 2018-07-10 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1583862 | 2018-07-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 17.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "17.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Eus Search vendor "Redhat" for product "Enterprise Linux Server Eus" | 7.5 Search vendor "Redhat" for product "Enterprise Linux Server Eus" and version "7.5" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0" | - |
Affected
| ||||||
| Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | <= 2.13.6 Search vendor "Git-scm" for product "Git" and version " <= 2.13.6" | - |
Affected
| ||||||
| Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | >= 2.14.0 <= 2.14.3 Search vendor "Git-scm" for product "Git" and version " >= 2.14.0 <= 2.14.3" | - |
Affected
| ||||||
| Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | >= 2.15.0 <= 2.15.1 Search vendor "Git-scm" for product "Git" and version " >= 2.15.0 <= 2.15.1" | - |
Affected
| ||||||
| Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | >= 2.16.0 <= 2.16.3 Search vendor "Git-scm" for product "Git" and version " >= 2.16.0 <= 2.16.3" | - |
Affected
| ||||||
| Git-scm Search vendor "Git-scm" | Git Search vendor "Git-scm" for product "Git" | 2.17.0 Search vendor "Git-scm" for product "Git" and version "2.17.0" | - |
Affected
| ||||||
| Gitforwindows Search vendor "Gitforwindows" | Git Search vendor "Gitforwindows" for product "Git" | <= 2.17.1 Search vendor "Gitforwindows" for product "Git" and version " <= 2.17.1" | - |
Affected
| ||||||