In Git, a critical vulnerability (CVE-2021-29468) has been identified, which manifests only when building for the Cygwin environment (a library for emulating the basic Linux API on Windows and a set of standard Linux programs for Windows). This vulnerability allows an attacker to execute code when extracting data ("git checkout") from a repository controlled by the attacker. The issue has been resolved in the git package 2.31.1-2 for Cygwin. The main Git project has not yet fixed the problem (it is unlikely that someone manually builds git for Cygwin rather than using a pre-packaged version).
The vulnerability is caused by treating the Cygwin environment as a Unix-like system instead of Windows, resulting in the absence of restrictions on the use of the '\' character in paths, while in Cygwin, as in Windows, this character can be used to separate directories. Consequently, by creating a specially modified repository containing symbolic links and files with the backslash character, it is possible to achieve arbitrary file overwriting when loading this repository in Cygwin (a similar vulnerability in Git for Windows was fixed in 2019). Once an attacker gains the ability to overwrite files, they can override hook calls in git and execute arbitrary code in the system.
Fonte: opennet.ru
