PT-2020-16362 · Microsoft · Git Credential Manager

Vitor Fernandes · Published 2020-12-08 · Updated 2021-02-18 · CVE-2020-26233

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Git Credential Manager Core versions prior to 2.0.289

Description The issue arises when recursively cloning a Git repository on Windows with submodules. If a malicious git.exe executable is present in the top-level repository, it will be started by Git Credential Manager Core when attempting to read configuration, instead of the git.exe found on the %PATH%. This only affects Git Credential Manager Core on Windows, not on macOS or Linux-based distributions.

Recommendations For versions prior to 2.0.289, update to version 2.0.289 or later to resolve the issue. As a temporary workaround, avoid recursively cloning untrusted repositories with the --recurse-submodules option.

Exploit

Fix

Weakness Enumeration

CWE-706

Related Identifiers

CVE-2020-26233

GHSA-2GQ7-WW4J-3M76

Affected Products

Git Credential Manager

References · 8

• 🔥 https://blog.blazeinfosec.com/attack-of-the-clones-2-git-command-client-remote-code-execution-strikes-back · Exploit
• https://github.com/microsoft/Git-Credential-Manager-Core/commit/61c0388e064babb3b4e60d3ec269e8a07ab3bc76 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26233 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26233 · Vendor Advisory
• https://github.com/microsoft/Git-Credential-Manager-Core/releases/tag/v2.0.289-beta · Note
• https://github.com/microsoft/Git-Credential-Manager-Core/security/advisories/GHSA-2gq7-ww4j-3m76 · Note
• https://t.me/cvenotify/6766 · Telegram Post
• https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt · Note