PT-2023-5951 · Git · Git For Windows

Veath1 · Publicado 2023-02-14 · Atualizado 2023-08-02 · CVE-2023-22743

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Git for Windows versions prior to 2.39.2

Description The issue is related to the Windows port of the revision control system Git. By carefully crafting a DLL and placing it into a subdirectory of a specific name next to the Git for Windows installer, Windows can be tricked into side-loading the DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation.

Recommendations For Git for Windows versions prior to 2.39.2, update to version 2.39.2 to resolve the issue. As a temporary workaround, never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.

Exploit

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

BDU:2023-06649

CVE-2023-22743

GHSA-GF48-X3VR-J5C3

GHSA-P2X9-PRP4-8GVQ

Produtos afetados

Git For Windows

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22743.json · Exploit
• https://github.com/git-for-windows/git/security/advisories/GHSA-p2x9-prp4-8gvq · Aviso do Fabricante
• https://github.com/git-for-windows/git/security/advisories/GHSA-gf48-x3vr-j5c3 · Aviso do Fabricante
• https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1 · Nota
• https://learn.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies- · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22743 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-06649 · Nota de Segurança
• https://learn.microsoft.com/en-us/windows/win32/controls/cookbook-overview?redirectedfrom=MSDN#using-comctl32dll-version-6-in-an-application-that-uses-only-standard-extensions · Aviso do Fabricante
• https://attack.mitre.org/techniques/T1574/002 · Nota
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-22743 · Aviso do Fabricante
• https://t.me/cvenotify/44304 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22743 · Aviso do Fabricante
• https://t.me/cibsecurity/58186 · Publicação no Telegram