PT-2020-16878 · Github · Git+1

Dawid Golunski · Published 2020-11-05 · Updated 2024-03-06 · CVE-2020-27955

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Git LFS versions 2.12.0 Git versions prior to 2.29.2

Description The issue allows Remote Code Execution (RCE) on Windows systems when Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory. This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. The problem does not affect Unix systems.

Recommendations For Git LFS version 2.12.0, update to version 2.12.1 or later. For Git versions prior to 2.29.2, update to version 2.29.2 or later. As a temporary workaround, consider avoiding untrusted repositories until a patch is available.

Exploit

Fix

Code Injection

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-94

CWE-427

CWE-426

Related Identifiers

BIT-GIT-LFS-2020-27955

BIT-GIT-LFS-2021-21237

CVE-2020-27955

GHSA-4G4P-42WC-9F3M

GHSA-CX3W-XQMC-84G5

Affected Products

Git

Git Lfs

References · 40

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/git_lfs_rce.rb · Exploit
• 🔥 https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955 · Exploit
• 🔥 https://github.com/r00t4dm/CVE-2020-27955 · Exploit
• 🔥 https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go · Exploit
• 🔥 https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html · Exploit
• 🔥 http://packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.html · Exploit
• 🔥 https://exploitbox.io · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Nov/1 · Exploit
• 🔥 http://packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-27955 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-git-lfs-2021-21237 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27955 · Security Note
• https://osv.dev/vulnerability/BIT-git-lfs-2020-27955 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cx3w-xqmc-84g5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4g4p-42wc-9f3m · Vendor Advisory