CVE-2018-17456
published 2018-10-06CVE-2018-17456: Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code…
PriorityP183critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
97.36%
99.9th percentile
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | git | < git 1:2.19.1-1 (bookworm) | git 1:2.19.1-1 (bookworm) |
| git-scm | git | >= 2.14.0 < 2.14.5 | 2.14.5 |
| git-scm | git | >= 2.15.0 < 2.15.3 | 2.15.3 |
| git-scm | git | >= 2.16.0 < 2.16.5 | 2.16.5 |
| git-scm | git | >= 2.17.0 < 2.17.2 | 2.17.2 |
| git-scm | git | >= 2.18.0 < 2.18.1 | 2.18.1 |
| git-scm | git | >= 2.19.0 < 2.19.1 | 2.19.1 |
| git | git | >= 0 < 1:2.19.1-1 | 1:2.19.1-1 |
| git | git | >= 0 < 1:2.19.1-1 | 1:2.19.1-1 |
| git | git | >= 0 < 1:2.19.1-1 | 1:2.19.1-1 |
| git | git | >= 0 < 1:2.19.1-1 | 1:2.19.1-1 |
| redhat | ansible_tower | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandexecve("/usr/lib/git-core/git", ["/usr/lib/git-core/git", "clone", "--no-checkout", "--progress", "--separate-git-dir", "/tmp/huhu/.git/modules/x:x", "-u./payload", "/tmp/huhu/x:x"],...↗
- →Inspect cloned repository .gitmodules files for any URL field value beginning with a '-' character, which indicates option injection attempt. ↗
- →Enable git fsck via 'transfer.fsckObjects' to detect malicious repository content (dash-prefixed submodule URLs) during fetch or push operations. ↗
- →Alert on submodule paths containing a colon character (e.g. 'x:x') in .gitmodules, as this is required to bypass local transport checks and enable payload execution. ↗
- →Detect git clone subprocess invocations where a '-u' flag (uploadpack override) appears in argument list, originating from a .gitmodules URL field. ↗
- →Monitor for Metasploit module 'exploits/multi/http/git_submodule_url_exec' activity — it stands up a malicious HTTP git server to serve the crafted superproject. ↗
- ·Exploitation on Windows (native) is blocked because colon characters are forbidden in path names; however, Git running under WSL or Cygwin on Windows remains exploitable. ↗
- ·OpenShift Container Platform source-to-image is impacted because it uses the git client packaged with RHEL7 container images; OCP 3.6 and earlier run source-to-image in a privileged container, increasing severity. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g986-jp62-5xq6: Git before 2
ghsa_unreviewed·2022-05-13
CVE-2018-17456 [CRITICAL] CWE-88 GHSA-g986-jp62-5xq6: Git before 2
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
OSV
CVE-2018-17456: Git before 2
osv·2018-10-06·CVSS 9.8
CVE-2018-17456 [CRITICAL] CVE-2018-17456: Git before 2
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
Ubuntu
Git vulnerability
vendor_ubuntu·2018-10-12
CVE-2018-17456 Git vulnerability
Title: Git vulnerability
Summary: Git could be made to run programs as your login if it recursively
opened a malicious git repository.
It was discovered that git did not properly validate git submodule
urls or paths. A remote attacker could possibly use this to craft a
git repository that causes arbitrary code execution when recursive
operations are used.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
git: arbitrary code execution via .gitmodules
vendor_redhat·2018-10-05·CVSS 9.8
CVE-2018-17456 [CRITICAL] CWE-77 git: arbitrary code execution via .gitmodules
git: arbitrary code execution via .gitmodules
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
An option injection flaw has been discovered in git when it recursively clones a repository with sub-modules. A remote attacker may configure a malicious repository and trick a user into recursively cloning it, thus executing arbitrary commands on the victim's machine.
Statement: OpenShift Container Platform (OCP) source-to-image uses the git client packaged with the OCP container images. Since RHEL7 and its associated images are impacted, source-to-ima
Debian
CVE-2018-17456: git - Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.1...
vendor_debian·2018·CVSS 9.8
CVE-2018-17456 [CRITICAL] CVE-2018-17456: git - Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.1...
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
Scope: local
bookworm: resolved (fixed in 1:2.19.1-1)
bullseye: resolved (fixed in 1:2.19.1-1)
forky: resolved (fixed in 1:2.19.1-1)
sid: resolved (fixed in 1:2.19.1-1)
trixie: resolved (fixed in 1:2.19.1-1)
No detection rules found.
Exploit-DB
Git Submodule - Arbitrary Code Execution
exploitdb·2018-10-16·CVSS 9.8
CVE-2018-17456 [CRITICAL] Git Submodule - Arbitrary Code Execution
Git Submodule - Arbitrary Code Execution
---
# CVE-2018-17456
I've gotten a couple of questions about exploitation for the
[recent RCE](https://marc.info/?l=git&m=153875888916397&w=2) in Git. So here we
go with some technical details.
## TL;DR
[Here](https://github.com/joernchen/poc-submodule) is a PoC repository.
EDB Note: Mirror ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45631.zip
## Exploitation
The `.gitmodules` file looks as follows:
```
[submodule "x:x"]
path = x:x
url = -u./payload
```
The actual command being injected is set by the url, `-u./payload`
points the `upload-pack` flag of git clone to the `payload` shell
script. Note also the `:` within the path, this part is needed to
actually get the `payload` script executed.
The path
Exploit-DB
Git Submodule - Arbitrary Code Execution (PoC)
exploitdb·2018-10-05·CVSS 9.8
CVE-2018-17456 [CRITICAL] Git Submodule - Arbitrary Code Execution (PoC)
Git Submodule - Arbitrary Code Execution (PoC)
---
These releases fix a security flaw (CVE-2018-17456), which allowed an
attacker to execute arbitrary code by crafting a malicious .gitmodules
file in a project cloned with --recurse-submodules.
When running "git clone --recurse-submodules", Git parses the supplied
.gitmodules file for a URL field and blindly passes it as an argument
to a "git clone" subprocess. If the URL field is set to a string that
begins with a dash, this "git clone" subprocess interprets the URL as
an option. This can lead to executing an arbitrary script shipped in
the superproject as the user who ran "git clone".
In addition to fixing the security issue for the user running "clone",
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
be used to
Metasploit
Malicious Git HTTP Server For CVE-2018-17456
metasploit·CVSS 9.8
CVE-2018-17456 [CRITICAL] Malicious Git HTTP Server For CVE-2018-17456
Malicious Git HTTP Server For CVE-2018-17456
This module exploits CVE-2018-17456, which affects Git versions 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 and lower. When a submodule url which starts with a dash e.g "-u./payload" is passed as an argument to git clone, the file "payload" inside the repository is executed. This module creates a fake git repository which contains a submodule containing the vulnerability. The vulnerability is triggered when the submodules are initialised (e.g git clone --recurse-submodules URL)
Bugzilla
CVE-2018-17456 git: arbitrary code execution via .gitmodules
bugzilla·2018-10-05·CVSS 9.8
CVE-2018-17456 [CRITICAL] CVE-2018-17456 git: arbitrary code execution via .gitmodules
CVE-2018-17456 git: arbitrary code execution via .gitmodules
A flaw was found in git which allows an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules.
References:
https://bugzilla.novell.com/show_bug.cgi?id=1110949
https://groups.google.com/forum/#!topic/git-packagers/fNLXf6LQC08
Discussion:
Created git tracking bugs for this issue:
Affects: fedora-all [bug 1636620]
Created libgit2 tracking bugs for this issue:
Affects: fedora-all [bug 1636621]
---
The relevant upstream commits which fix the issue:
https://github.com/git/git/commit/98afac7a7cefdca0d2c4917dd8066a59f7088265
https://github.com/git/git/commit/f6adec4e329ef0e25e14c63b735a5956dc67b8bc
https://github.com/git/git/commit/273c61496f88c6495b886acb1041
Bugzilla
CVE-2018-17456 git: arbitrary code execution via .gitmodules [fedora-all]
bugzilla·2018-10-05·CVSS 9.8
CVE-2018-17456 [CRITICAL] CVE-2018-17456 git: arbitrary code execution via .gitmodules [fedora-all]
CVE-2018-17456 git: arbitrary code execution via .gitmodules [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2018-17456 libgit2: git: arbitrary code execution via .gitmodules [fedora-all]
bugzilla·2018-10-05·CVSS 9.8
CVE-2018-17456 [CRITICAL] CVE-2018-17456 libgit2: git: arbitrary code execution via .gitmodules [fedora-all]
CVE-2018-17456 libgit2: git: arbitrary code execution via .gitmodules [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlhttp://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.htmlhttp://www.securityfocus.com/bid/105523http://www.securityfocus.com/bid/107511http://www.securitytracker.com/id/1041811https://access.redhat.com/errata/RHSA-2018:3408https://access.redhat.com/errata/RHSA-2018:3505https://access.redhat.com/errata/RHSA-2018:3541https://access.redhat.com/errata/RHSA-2020:0316https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46https://marc.info/?l=git&m=153875888916397&w=2https://seclists.org/bugtraq/2019/Mar/30https://usn.ubuntu.com/3791-1/https://www.debian.org/security/2018/dsa-4311https://www.exploit-db.com/exploits/45548/https://www.exploit-db.com/exploits/45631/https://www.openwall.com/lists/oss-security/2018/10/06/3http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.htmlhttp://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.htmlhttp://www.securityfocus.com/bid/105523http://www.securityfocus.com/bid/107511http://www.securitytracker.com/id/1041811https://access.redhat.com/errata/RHSA-2018:3408https://access.redhat.com/errata/RHSA-2018:3505https://access.redhat.com/errata/RHSA-2018:3541https://access.redhat.com/errata/RHSA-2020:0316https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46https://marc.info/?l=git&m=153875888916397&w=2https://seclists.org/bugtraq/2019/Mar/30https://usn.ubuntu.com/3791-1/https://www.debian.org/security/2018/dsa-4311https://www.exploit-db.com/exploits/45548/https://www.exploit-db.com/exploits/45631/https://www.openwall.com/lists/oss-security/2018/10/06/3
2018-10-06
Published