PT-2016-4079 · Git · Git-Fastclone

Bburky · Published 2016-11-03 · Updated 2020-06-10 · CVE-2015-8968

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions git-fastclone versions prior to 1.0.1

Description The issue allows for arbitrary shell command execution from .gitmodules. An attacker can exploit this by instructing a user to run a recursive clone from a controlled repository, or by performing a man-in-the-middle (MITM) attack on an unencrypted git clone. The ext command will be executed when the repository is recursively cloned or when submodules are updated. This attack is effective for both local and remote repository clones.

Recommendations For git-fastclone versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider avoiding recursive clones and submodule updates from untrusted repositories. Restrict access to the ext command to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2015-8968

GHSA-8GG6-3R63-25M8

Affected Products

Git-Fastclone

References · 9

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/git-fastclone/CVE-2015-8968.yml · Exploit
• 🔥 https://hackerone.com/reports/104465 · Exploit
• https://github.com/square/git-fastclone/pull/2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8968 · Security Note
• https://osv.dev/vulnerability/GHSA-8gg6-3r63-25m8 · Vendor Advisory
• https://github.com/square/git-fastclone · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8968 · Note
• http://securityfocus.com/bid/81433 · Note
• https://web.archive.org/web/20200227213019/http://securityfocus.com/bid/81433 · Note