CVE-2018-11235
published 2018-05-30CVE-2018-11235: In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a…
PriorityP265high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
48.06%
98.8th percentile
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | xcode | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | git | < git 1:2.17.1-1 (bookworm) | git 1:2.17.1-1 (bookworm) |
| git-scm | git | <= 2.13.6 | — |
| git-scm | git | — | — |
| git-scm | git | 2.14.0 – 2.14.3 | — |
| git-scm | git | 2.15.0 – 2.15.1 | — |
| git-scm | git | 2.16.0 – 2.16.3 | — |
| git | git | >= 0 < 1:2.17.1-1 | 1:2.17.1-1 |
| git | git | >= 0 < 1:2.17.1-1 | 1:2.17.1-1 |
| git | git | >= 0 < 1:2.17.1-1 | 1:2.17.1-1 |
| git | git | >= 0 < 1:2.17.1-1 | 1:2.17.1-1 |
| git | git | >= 0 < 1:1.9.1-1ubuntu0.8 | 1:1.9.1-1ubuntu0.8 |
| git | git | >= 0 < 1:2.7.4-0ubuntu1.4 | 1:2.7.4-0ubuntu1.4 |
| git | git | >= 0 < 1:2.17.1-1ubuntu0.1 | 1:2.17.1-1ubuntu0.1 |
| gitforwindows | git | <= 2.17.1 | — |
| gitpython_project | gitpython | >= 0 < 3.1.58 | 3.1.58 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for 'git clone --recurse-submodules' invocations against untrusted repositories; this is the exact trigger command for CVE-2018-11235 exploitation. ↗
- →Inspect .gitmodules files for submodule names containing '../' sequences, which enable directory traversal into $GIT_DIR/modules and placement of malicious post-checkout hooks. ↗
- →Detect post-checkout hook execution originating from a cloned remote submodule; hooks should never be sourced from a remote server under normal Git design. ↗
- →Alert on git daemon processes spawned on non-standard ports (e.g. 11992) as part of attacker-controlled repository hosting infrastructure used to serve malicious submodule repos. ↗
- ·Git versions 2.13.7+, 2.14.4+, 2.15.2+, 2.16.4+, and 2.17.1+ are patched; detection focus should be on unpatched installations running vulnerable versions. ↗
- ·Red Hat Enterprise Linux 6 shipped a version of git that did not include the vulnerable code and is not affected. ↗
- ·GitHub actively blocks pushes of repositories containing malicious submodules, reducing (but not eliminating) exposure from GitHub-hosted repos. ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa7.8HIGH
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2018-11235: Xcode 9.4.1
vendor_apple·2018-06-13·CVSS 7.8
CVE-2018-11235 [HIGH] CVE-2018-11235: Xcode 9.4.1
Apple Security Update: About the security content of Xcode 9.4.1
Product: Xcode
Version: 9.4.1
CVE: CVE-2018-11235
Component: Git
Impact: Multiple issues in git, the most significant of which may lead to arbitrary code execution
Description: Multiple issues existed in git. These issues were addressed by updating git to version 2.15.2.
Ubuntu
Git vulnerabilities
vendor_ubuntu·2018-06-05·CVSS 7.5
CVE-2018-11233 [HIGH] Git vulnerabilities
Title: Git vulnerabilities
Summary: Several security issues were fixed in Git.
Etienne Stalmans discovered that git did not properly validate git
submodules files. A remote attacker could possibly use this to craft a
git repo that causes arbitrary code execution when "git clone
--recurse-submodules" is used. (CVE-2018-11235)
It was discovered that an integer overflow existed in git's pathname
consistency checking code when used on NTFS filesystems. An attacker could
use this to cause a denial of service or expose sensitive information.
(CVE-2018-11233)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
git: arbitrary code execution when recursively cloning a malicious repository
vendor_redhat·2018-05-30·CVSS 7.8
CVE-2018-11235 [HIGH] CWE-20 git: arbitrary code execution when recursively cloning a malicious repository
git: arbitrary code execution when recursively cloning a malicious repository
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
Statement: This issue did not affect the versions of git as shipped with Red Hat Enterprise Linux 6 as they did not include the vulnerable co
Debian
CVE-2018-11235: git - In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before ...
vendor_debian·2018·CVSS 7.8
CVE-2018-11235 [HIGH] CVE-2018-11235: git - In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before ...
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
Scope: local
bookworm: resolved (fixed in 1:2.17.1-1)
bullseye: resolved (fixed in 1:2.17.1-1)
forky: resolved (fixed in 1:2.17.1-1)
sid: resolved (fixed in 1:2.17.1-1)
trixie: resolved (fixed in 1:2.17.1-1)
GHSA
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
ghsa·2026-08-07·CVSS 7.8
CVE-2018-11235 [HIGH] CWE-22 GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
### Summary
GitPython computes the on-disk location of a submodule's separate Git directory (`.git/modules/`) from the submodule's `.gitmodules` section name with no validation. Because that name is fully attacker-controlled content of a cloned repository, a malicious repository can set a submodule name to a traversal string (e.g. `../../../../home/victim/.something`) and cause GitPython to create and initialize a full Git repository at an attacker-chosen filesystem path outside the intended clone directory. The only precondition is that a victim clones the malicious repository with GitPython and runs submodule initialization (`submodule_update(init=True)` / `sm.up
GHSA
GHSA-v6w3-vcjx-mwhx: In Git before 2
ghsa_unreviewed·2022-05-13
CVE-2018-11235 [HIGH] CWE-22 GHSA-v6w3-vcjx-mwhx: In Git before 2
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
OSV
git vulnerabilities
osv·2018-06-05·CVSS 7.5
CVE-2018-11235 [HIGH] git vulnerabilities
git vulnerabilities
Etienne Stalmans discovered that git did not properly validate git
submodules files. A remote attacker could possibly use this to craft a
git repo that causes arbitrary code execution when "git clone
--recurse-submodules" is used. (CVE-2018-11235)
It was discovered that an integer overflow existed in git's pathname
consistency checking code when used on NTFS filesystems. An attacker could
use this to cause a denial of service or expose sensitive information.
(CVE-2018-11233)
OSV
CVE-2018-11235: In Git before 2
osv·2018-05-30·CVSS 7.8
CVE-2018-11235 [HIGH] CVE-2018-11235: In Git before 2
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
No detection rules found.
Bugzilla
libgit2: arbitrary code execution when recursively cloning a malicious repository (git CVE-2018-11235 variant) [fedora-all]
bugzilla·2018-06-29·CVSS 7.8
CVE-2018-11235 [HIGH] libgit2: arbitrary code execution when recursively cloning a malicious repository (git CVE-2018-11235 variant) [fedora-all]
libgit2: arbitrary code execution when recursively cloning a malicious repository (git CVE-2018-11235 variant) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE:
Bugzilla
libgit2: arbitrary file write when recursively cloning a malicious repository (git CVE-2018-11235 variant)
bugzilla·2018-06-29·CVSS 7.8
CVE-2018-11235 [HIGH] libgit2: arbitrary file write when recursively cloning a malicious repository (git CVE-2018-11235 variant)
libgit2: arbitrary file write when recursively cloning a malicious repository (git CVE-2018-11235 variant)
A flaw was found in libgit2 which allows arbitrary file write when recursively cloning a malicious repository. libgit2 can be tricked into writing files outside the .git/modules directory. This is a variant of git CVE-2018-11235.
Discussion:
Created libgit2 tracking bugs for this issue:
Affects: fedora-all [bug 1596744]
---
After deeper analysis with upstream help, we determined libgit2 is not vulnerable to any variant of CVE-2018-11235.
Thus I'm closing this as NOTABUG.
Bugzilla
CVE-2018-11235 libgit2: git: arbitrary code execution when recursively cloning a malicious repository [fedora-all]
bugzilla·2018-06-27·CVSS 7.8
CVE-2018-11235 [HIGH] CVE-2018-11235 libgit2: git: arbitrary code execution when recursively cloning a malicious repository [fedora-all]
CVE-2018-11235 libgit2: git: arbitrary code execution when recursively cloning a malicious repository [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issu
Bugzilla
CVE-2018-11235 git: arbitrary code execution when recursively cloning a malicious repository [fedora-all]
bugzilla·2018-05-30·CVSS 7.8
CVE-2018-11235 [HIGH] CVE-2018-11235 git: arbitrary code execution when recursively cloning a malicious repository [fedora-all]
CVE-2018-11235 git: arbitrary code execution when recursively cloning a malicious repository [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2018-11235 git: arbitrary code execution when recursively cloning a malicious repository
bugzilla·2018-05-29·CVSS 7.8
CVE-2018-11235 [HIGH] CVE-2018-11235 git: arbitrary code execution when recursively cloning a malicious repository
CVE-2018-11235 git: arbitrary code execution when recursively cloning a malicious repository
A flaw was found in git which allows arbitrary code to be executed when running 'git clone --recurse-submodules` (or the deprecated 'git clone --recursive' synonym). A malicious repository can include a .gitmodules submodule config file which points outside of the repository. When git clones such a repository it can be tricked into running hooks within the cloned submodule, which is under the control of the attacker.
References:
https://public-inbox.org/git/[email protected]/
https://www.edwardthomson.com/blog/upgrading_git_for_cve2018_11235.html
https://news.ycombinator.com/item?id=17181238
Discussion:
Updated Fedora builds have been submitted for current releases:
F2
CTF
20180922-dctfquals2018 / README
ctf_writeups·2018
20180922-dctfquals2018 / README
# D-CTF Quals 2018
**It's recommended to read our responsive [web version](https://balsn.tw/ctf_writeup/20180922-dctfquals2018/) of this writeup.**
- [D-CTF Quals 2018](#d-ctf-quals-2018)
- [Web](#web)
- [Get Admin](#get-admin)
- [Reverse](#reverse)
- [ransomware](#ransomware)
- [Exploit](#exploit)
- [Lucky?](#lucky)
- [Even more lucky?](#even-more-lucky)
- [Online Linter](#online-linter)
## Web
### Get Admin
In order to get admin, the objective is to make `$u['id']=1` in the encrpted cookies. The ability we have is that we can register arbitrary unique username and email. The server will always return the encrypted cookie for us.
```php
if(!empty($_COOKIE['user'])) {
$u = decryptCookie($_COOKIE['user']);
if($u['id'] > 0) {
$_SESSION['userid'] = $u['id'];
header("Location: /admin.
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlhttp://www.securityfocus.com/bid/104345http://www.securitytracker.com/id/1040991https://access.redhat.com/errata/RHSA-2018:1957https://access.redhat.com/errata/RHSA-2018:2147https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/https://marc.info/?l=git&m=152761328506724&w=2https://security.gentoo.org/glsa/201805-13https://usn.ubuntu.com/3671-1/https://www.debian.org/security/2018/dsa-4212https://www.exploit-db.com/exploits/44822/http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlhttp://www.securityfocus.com/bid/104345http://www.securitytracker.com/id/1040991https://access.redhat.com/errata/RHSA-2018:1957https://access.redhat.com/errata/RHSA-2018:2147https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/https://marc.info/?l=git&m=152761328506724&w=2https://security.gentoo.org/glsa/201805-13https://usn.ubuntu.com/3671-1/https://www.debian.org/security/2018/dsa-4212https://www.exploit-db.com/exploits/44822/
2018-05-30
Published