Corrective releases of the distributed version control system Git 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, and 2.14.6 have been released, addressing vulnerabilities that allow an attacker to rewrite arbitrary paths in the file system, execute remote code, or overwrite files in the '.git/' directory. Most of the issues were identified by employees of the Microsoft Security Response Center, five out of eight vulnerabilities are specific to the Windows platform.
Microsoft Security Response Center, five out of eight vulnerabilities are specific to the Windows platform.
- — streaming command 'feature export-marks=path' writes marks to arbitrary directories, which can be exploited to rewrite arbitrary paths in the file system when executing the 'git fast-import' operation with unverified input.
- — improper escaping of command line arguments to remote code execution by an attacker during recursive cloning using ssh:// URLs. In particular, improper handling of escaping arguments ending in a backslash (e.g., 'test \'). In this case, when enclosing the argument in double quotes, the last quote would be escaped, allowing for the injection of their options into the command line.
- — during recursive cloning of submodules ('clone --recurse-submodules') in a Windows environment under certain conditions to initiate the use of a single git directory twice (.git, git~1, git~2, and git~N are recognized as one directory in NTFS, but this situation was only checked for git~1), which could be used to write in the '.git' directory. To execute their code, an attacker could, for example, inject their script through the post-checkout handler in the .git/config file.
- — the handling of drive letter names in Windows paths when translating paths like 'C:\' was designed only to replace single-letter Latin identifiers, but did not account for the possibility of creating virtual drives assigned via 'subst letter:path'. Such paths were handled not as absolute paths but as relative paths, allowing for writing to arbitrary directories outside the working tree of directories when cloning a malicious repository (e.g., when using digits or unicode characters in the drive name — '1:\what\the\hex.txt' or 'ä:\tschibät.sch').
- When working on the Windows platform, the use of alternative data streams in NTFS, created by adding the ':stream-name:stream-type' flag to the file name, could overwrite files in the '.git/' directory when cloning a malicious repository. For example, the name '.git::$INDEX_ALLOCATION' in NTFS was processed as a valid link to the '.git' directory.
- — when using Git in a WSL (Windows Subsystem for Linux) environment while accessing the working directory, against name manipulation in NTFS (attacks via FAT name translation were possible, for example, '.git' could be accessed through the 'git~1' directory).
- —
writing to the '.git/' directory on the Windows platform when cloning malicious repositories that contained files with backslashes in their names (e.g., 'a\b'), which is permissible in Unix/Linux but is interpreted as part of the path in Windows. - — insufficient checking of submodule names could be used to organize targeted attacks that potentially during recursive cloning to the execution of the attacker's code. Git did not prevent a submodule directory from being created within another submodule's directory, which in most cases could only cause confusion but potentially does not exclude overwriting the contents of another module during recursive cloning (for instance, submodule directories 'hippo' and 'hippo/hooks' are placed as '.git/modules/hippo/' and '.git/modules/hippo/hooks/', and the hooks directory in hippo may be separately used to hold executable handlers.
Windows users are urged to urgently update their version of Git, and until they do, to refrain from cloning unverified repositories. If there is no immediate option to update Git, it is recommended to lower the risk of attack by not running 'git clone --recurse-submodules' and 'git submodule update' with unverified repositories, not using 'git fast-import' with unverified input streams, and not cloning repositories in NTFS-based partitions.
For additional protection in new releases, the use of constructs in .gitmodules in the form 'submodule.{name}.update=!command' has also been prohibited. To track the release of package updates for distributions, you can check the pages ,, , , , , , .
Source: opennet.ru
