Command injection in Git products - CVE-2018-17456

Vulnerability identifier: #VU15167

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-17456

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists in the Git command line client, Git Desktop, and Atom due to command injection during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.. A remote attacker can use a specially crafted.gitmodules file that contains an URL that starts with a dash. By using a dash, when Git clones a repository using the --recurse-submodules argument, the command will interpret the URL as an option that can be used to execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

GitHub Desktop
Atom
Git
Arch Linux
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Fedora
Red Hat Enterprise Linux for Power
Slackware Linux
Opensuse
git (Alpine package)
libgit2
git

The vulnerability has been fixed in Git 2.19.1 (with backports in 2.14.5, 2.15.3, 2.16.5, 2.17.2, and 2.18.1), GitHub Desktop 1.4.2 and 1.4.3-beta0, and Atom 1.31.2 and 1.32.0-beta3.

GitHub Desktop - addressed in versions 1.4.2, 1.4.3 beta0
Atom - addressed in versions 1.31.2, 1.32.0 beta3
Git - addressed in versions 2.15.3, 2.16.5, 2.17.2, 2.18.1, 2.19.1
git (Alpine package) - update to 2.11.3-r2
libgit2 - addressed in versions 0.26.7-1.el7, 0.26.7-1.fc27, 0.26.7-1.fc28, 0.26-20181006095632.6c81f848, 0.26-20181006095632.9c690d0e, 0.27.5-1.fc29, 0.27-20181006095357.6c81f848, 0.27-20181006095357.9c690d0e
git - addressed in versions 2.14.5-1.fc27, 2.17.2-1.fc28, 2.19.1-1.fc29

• Exploit #6109 - Git Submodule - Arbitrary Code Execution (June 17, 2021)
• Exploit #6119 - Git Submodule - Arbitrary Code Execution (PoC) (June 17, 2021)
• Exploit #1553 - Malicious Git HTTP Server For CVE-2018-17456 (March 18, 2020)

• https://marc.info/?l=git&m=153875888916397&w=2

• Remote code execution in Git, GitHub Desktop and Atom
• Debian update for git
• Arch Linux update for git
• Slackware Linux update for git
• OpenSUSE Linux update for git
• OpenSUSE Linux update for git
• Amazon Linux AMI update for git
• OpenSUSE Linux update for libgit2
• Red Hat update for git
• Red Hat update for git
• OpenSUSE Linux update for git
• Command injection in git (Alpine package)
• Fedora 27 update for git
• Fedora 29 update for git
• Fedora 28 update for git
• Fedora 28 Modular update for libgit2
• Fedora 29 Modular update for libgit2
• Fedora 29 Modular update for libgit2
• Fedora 28 Modular update for libgit2
• Fedora 29 update for libgit2
• Fedora 27 update for libgit2
• Fedora 28 update for libgit2
• Fedora EPEL 7 update for libgit2