CVE-2022-24765: Git for Windows Uncontrolled Search for Git Directory Vulnerability
Summary
CVE-2022-24765: Uncontrolled search for the Git directory in Git for Windows. Affects git versions < 2.35.2. Fixed in 2.35.2. How to fix ↓
Also tracked for
- git · Alpine:v3.13
The same CVE-2022-24765 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git for Windows is a widely used version control system that incorporates Windows-specific patches to enhance its functionality for Windows users. It allows developers to track changes in their code, collaborate with others, and manage project versions efficiently. However, due to its design, Git for Windows can be vulnerable to certain security issues, particularly in multi-user environments where untrusted parties may have access to the same file system.
Vulnerability Detail
The vulnerability identified as CVE-2022-24765 arises from Git for Windows' uncontrolled search for Git directories. This issue is particularly concerning for users on multi-user machines, where untrusted users can create a folder named 'C:.git'. When Git operations are performed outside a repository, Git inadvertently respects the configurations found in this malicious directory. This can lead to unauthorized access to sensitive configurations and potentially harmful actions being executed without the user's consent. The vulnerability affects various user scenarios, including Git Bash users and those using IDEs like Visual Studio, where simply creating a new project can trigger the issue.
How To Fix
Minimum fixed version
2.35.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, users can implement the following workaround: create a folder named '.git' on all drives where Git commands are executed and remove read/write access from those folders. This can be done using the following command in PowerShell:
New-Item -ItemType Directory -Path 'C:\.git'
$acl = Get-Acl 'C:\.git'
$acl.SetAccessRuleProtection($true, $false)
Set-Acl 'C:\.git' $acl
Conclusion
CVE-2022-24765 presents a significant risk for users of Git for Windows, particularly in shared environments. It is crucial to upgrade to the patched version or implement the recommended workaround to mitigate potential threats. Staying informed about such vulnerabilities is essential for maintaining the security of your development environment.
See every vulnerability recorded for git →
FAQ
CVE-2022-24765 is a vulnerability in Git for Windows that allows untrusted users to manipulate Git configurations by creating a malicious '.git' directory.
Users of Git for Windows, especially in multi-user environments, are at risk if untrusted parties have access to the same hard disk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If upgrading is not possible, you can create a '.git' folder on all drives where Git commands are run and restrict access to it as a temporary workaround.
The vulnerability can lead to unauthorized access to sensitive configurations, allowing malicious actions to be executed without the user's knowledge.
Related vulnerabilities
Recent vulnerabilities recorded for git.
