Input validation error in Git LFS - CVE-2020-27955
Published: November 5, 2020 / Updated: February 2, 2023
Vulnerability identifier: #VU48175
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-27955
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to insufficient validation of files. A remote user can upload a specially crafted binary to the repository and execute arbitrary code on the system.
Affected software
Git LFS
Autodesk Infraworks
Autodesk Infraworks
How to mitigate CVE-2020-27955
Install updates from vendor's website.
Git LFS - update to 2.12.1
Autodesk Infraworks - addressed in versions 2020.2 Hotfix 6, 2021.2 Hotfix 6, 2022.1 Hotfix 4
Autodesk Infraworks - addressed in versions 2020.2 Hotfix 6, 2021.2 Hotfix 6, 2022.1 Hotfix 4
Links to Public Exploits and PoC-codes
- Exploit #8792 - CVE-2020-27955-LFS () (February 2, 2023)
- Exploit #8681 - CVE-2020-27955 () (December 18, 2022)
- Exploit #7179 - git-lfs-RCE-exploit-CVE-2020-27955-Go () (December 15, 2021)
- Exploit #6751 - Git Remote Code Execution via git-lfs (CVE-2020-27955) (September 15, 2021)
- Exploit #6596 - CVE-2020-27955-LFS-main () (August 2, 2021)
- Exploit #6454 - CVE-2020-27955 (Git-LFS RCE Test) (June 20, 2021)
- Exploit #5405 - CVE-2020-27955 () (May 13, 2021)
- Exploit #5339 - CVE-2020-27955-LFS () (May 3, 2021)
- Exploit #5336 - CVE-2020-27955 (CVE-2020-27955) (May 3, 2021)
- Exploit #5263 - CVE-2020-27955 (CVE-2020-27955 Poc) (April 1, 2021)
- Exploit #5163 - git-lfs-RCE-exploit-CVE-2020-27955-revshell () (February 23, 2021)
- Exploit #4914 - git-lfs-RCE-exploit-CVE-2020-27955-revshell () (December 11, 2020)
- Exploit #4876 - CVE-2020-27955 () (November 24, 2020)
- Exploit #4874 - cve-2020-27955-poc () (November 23, 2020)
- Exploit #4805 - Input validation error (November 6, 2020)
- Exploit #4797 - git-lfs-RCE-exploit-CVE-2020-27955 (Git-lfs RCE exploit CVE-2020-27955 - tested on Windows on: git, gh cli, GitHub Desktop, Visual Studio, SourceTree etc.) (November 6, 2020)