PT-2023-5861 · Git · Git For Windows
Ycdxsb
·
Published
2023-04-25
·
Updated
2023-05-04
·
CVE-2023-29011
CVSS v3.1
7.5
High
| Vector | AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Git for Windows versions prior to 2.40.1
Description
The issue is related to the executable file connect.exe in Git for Windows, which implements a SOCKS5 proxy. This vulnerability is associated with an uncontrolled search path element. Exploitation of the vulnerability may allow an attacker to execute arbitrary code. The problem arises because the location of connect.exe's config file is hard-coded, and any authenticated user can create the directory where the config file is located, making it susceptible to malicious files.
Recommendations
For versions prior to 2.40.1, update to Git for Windows version 2.40.1 to resolve the issue.
As a temporary workaround, create the folder etc on all drives where Git commands are run, and remove read/write access from those folders.
Alternatively, watch out for malicious :etcconnectrc files on multi-user machines.
Exploit
Fix
Uncontrolled Search Path Element
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Git For Windows