Git - Execution of Arbitrary Code via Symbolic Links and Clean/Smudge Filters
Summary
CVE-2021-21300: Git is an open-source distributed revision control system. Affects git across 3 version ranges.
< 2.22.5-r0
< 37f0a4afad027cf030747a1ef45537ba86162960
< 684dd4c2b414bcf648505e74498a608f28de4592
Fixed in 2.22.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is an open-source distributed revision control system widely used for version control of source code during software development. It provides a platform for multiple developers to collaborate on a project, track changes, and manage code repositories. Git supports various features such as branching, merging, and tagging, making it a versatile tool for managing codebase history. However, a vulnerability has been discovered in Git that allows the execution of arbitrary code when cloning a repository containing symbolic links and clean/smudge filters.
Vulnerability Detail
The vulnerability, identified as CVE-2021-21300, affects Git versions starting from 2.14.2. When cloning a repository that includes symbolic links and files utilizing clean/smudge filters like Git LFS (Large File Storage), the vulnerability can be exploited on case-insensitive file systems such as NTFS, HFS+, or APFS. This vulnerability arises due to the execution of just-checked out scripts during the cloning process. By crafting a malicious repository, an attacker can execute arbitrary code on the target system. Git for Windows, which includes Git LFS by default, is particularly vulnerable to this attack. The severity of this vulnerability is rated as CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, with a score of 7.5.
How To Fix
Minimum fixed version
2.22.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, symbolic link support can be disabled in Git by running the command git config --global core.symlinks false. This prevents the described attack from being successful. Additionally, if no clean/smudge filters like Git LFS are configured globally before cloning a repository, the attack can be thwarted. However, it is always advisable to exercise caution and avoid cloning repositories from untrusted sources.
Conclusion
The vulnerability in Git allows the execution of arbitrary code when cloning a repository containing symbolic links and clean/smudge filters. It is crucial to update Git to one of the patched versions released on March 9th, 2021, to mitigate this vulnerability. Disabling symbolic link support in Git and avoiding cloning repositories from untrusted sources are recommended precautions. For further support on vulnerability remediation, reach out to DevNack.com.
See every vulnerability recorded for git →
FAQ
Git is an open-source distributed revision control system used for managing source code during software development. It enables multiple developers to collaborate on a project and track changes to the codebase.
The vulnerability affects Git versions starting from 2.14.2. It has been patched in versions 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, and 2.17.6.
To fix this vulnerability, update Git to one of the patched versions released on March 9th, 2021. The fixed versions include 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, and 2.17.6.
Yes, you can disable symbolic link support in Git by running the command git config --global core.symlinks false. This prevents the described attack from being successful.
To avoid this vulnerability, it is best to avoid cloning repositories from untrusted sources. Additionally, ensure that clean/smudge filters like Git LFS are not configured globally before cloning a repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
