PT-2016-4079 · Git · Git-Fastclone

Bburky · Publicado 2016-11-03 · Atualizado 2020-06-10 · CVE-2015-8968

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions git-fastclone versions prior to 1.0.1

Description The issue allows for arbitrary shell command execution from .gitmodules. An attacker can exploit this by instructing a user to run a recursive clone from a controlled repository, or by performing a man-in-the-middle (MITM) attack on an unencrypted git clone. The ext command will be executed when the repository is recursively cloned or when submodules are updated. This attack is effective for both local and remote repository clones.

Recommendations For git-fastclone versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider avoiding recursive clones and submodule updates from untrusted repositories. Restrict access to the ext command to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2015-8968

GHSA-8GG6-3R63-25M8

Produtos afetados

Git-Fastclone

Referências · 9

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git-fastclone/CVE-2015-8968.yml · Exploit
• 🔥 https://hackerone.com/reports/104465 · Exploit
• https://github.com/square/git-fastclone/pull/2 · Aviso do Fabricante
• https://github.com/square/git-fastclone · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8968 · Nota
• http://securityfocus.com/bid/81433 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8968 · Nota de Segurança
• https://web.archive.org/web/20200227213019/http://securityfocus.com/bid/81433 · Nota
• https://osv.dev/vulnerability/GHSA-8gg6-3r63-25m8 · Aviso do Fabricante