Remote Code Execution in Git
Summary
CVE-2017-1000117: A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Affects git versions < 2.14.1-r0. Fixed in 2.14.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed version control system that allows multiple developers to collaborate on a project. It is widely used for managing source code and tracking changes. However, a vulnerability in Git allows a malicious third-party to execute arbitrary code on a victim's machine by tricking them into visiting a crafted URL.
Vulnerability Detail
The vulnerability, identified as CVE-2017-1000117, occurs when a victim visits a malicious "ssh://..." URL. This URL can be embedded in the .gitmodules file of a malicious project. When the victim runs the command "git clone --recurse-submodules" to clone the project, the malicious code is executed. This can lead to the execution of any program on the victim's machine, potentially resulting in unauthorized access, data loss, or other malicious activities.
How To Fix
Minimum fixed version
2.14.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Git to the patched version to ensure the security of the system.
Conclusion
The remote code execution vulnerability in Git (CVE-2017-1000117) poses a significant risk to systems running vulnerable versions of Git. To mitigate this risk, it is crucial to update Git to version 2.14.1-r0 or later. Failure to do so may result in unauthorized access, data loss, or other malicious activities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git →
FAQ
This vulnerability allows an attacker to execute arbitrary code on a victim's machine, potentially leading to unauthorized access, data loss, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your Git installation is affected by this vulnerability. Simply provide the manifest file (e.g., package-lock.json) of your application, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, updating Git to version 2.14.1-r0 or later will fix this vulnerability. It is recommended to update your Git installation as soon as possible.
Yes, this vulnerability can be exploited remotely by tricking a victim into visiting a malicious URL.
There have been reports of this vulnerability being exploited in the wild. It is crucial to update Git to the patched version to protect against potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
