CVE-2018-11235 in Git
Summary
by MITRE
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/17/2023
This vulnerability represents a critical remote code execution flaw in Git versions prior to the specified patches, specifically affecting releases from 2.13.7 through 2.17.0. The issue stems from improper handling of submodule names within the .gitmodules configuration file, which allows attackers to craft malicious entries that exploit directory traversal mechanisms. When a user executes git clone --recurse-submodules on a compromised repository, the system processes submodule names directly from the remote .gitmodules file without adequate sanitization, creating a pathway for arbitrary code execution through specially crafted directory traversal sequences.
The technical exploitation occurs through a combination of directory traversal and hook execution mechanisms within Git's submodule handling system. Submodule names are extracted from the .gitmodules file and subsequently appended to the $GIT_DIR/modules path, enabling attackers to manipulate the file system traversal by including "../" sequences in the submodule name. This directory traversal vulnerability allows malicious actors to escape the intended submodule directory structure and potentially execute code in unexpected locations. The vulnerability specifically targets the post-checkout hook execution mechanism, which normally should not retrieve hooks from remote repositories but instead bypasses this protection when processing malicious submodule names.
The operational impact of this vulnerability is severe as it enables attackers to execute arbitrary code on victim machines simply by cloning a malicious repository with the appropriate submodule configuration. This represents a privilege escalation vector where a remote attacker can gain control over a user's system without requiring any special privileges or interactive user actions beyond the standard git clone operation. The vulnerability affects any system running affected Git versions that execute the --recurse-submodules flag, making it particularly dangerous in environments where developers frequently clone repositories with submodules or when automated build systems perform recursive cloning operations.
This vulnerability maps directly to CWE-22 Directory Traversal and CWE-78 Command Injection, with the directory traversal aspect being the primary attack vector. From an attack framework perspective, this aligns with ATT&CK technique T1059.001 Command and Scripting Interpreter and T1068 Exploitation for Privilege Escalation. The vulnerability demonstrates a classic case of insufficient input validation combined with unsafe file system operations. Organizations should immediately update to Git versions 2.13.7, 2.14.4, 2.15.2, 2.16.4, or 2.17.1 respectively, depending on their current Git version. Additional mitigations include implementing strict repository access controls, disabling recursive submodule cloning in automated environments, and conducting security reviews of all .gitmodules files in critical repositories. System administrators should also monitor for suspicious cloning activities and implement network-level controls to prevent access to known malicious repositories. The vulnerability underscores the importance of validating all user-provided input in version control systems and highlights the risks associated with recursive operations that traverse multiple repositories without proper sanitization.