Critical Vulnerability in Git Package: Remote Code Execution via Malicious SSH URLs
Summary
ALPINE-CVE-2017-1000117: A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Affects git versions < 2.14.1-r0. Fixed in 2.14.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in source code during software development. It is known for its speed, efficiency, and support for distributed, non-linear workflows. However, Git is vulnerable to a specific issue where a crafted 'ssh://...' URL can lead to remote code execution if a user unknowingly executes commands that interact with malicious repositories.
Vulnerability Detail
The vulnerability, identified as CVE-2017-1000117, allows a malicious third party to craft a deceptive 'ssh://...' URL that, when accessed by an unsuspecting user, can execute arbitrary programs on the victim's machine. This can occur if the malicious URL is included in a .gitmodules file of a project, tricking the user into running 'git clone --recurse-submodules'. The potential ramifications include unauthorized access to sensitive data, system compromise, and further exploitation of the affected system.
How To Fix
Minimum fixed version
2.14.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid executing 'git clone --recurse-submodules' on untrusted repositories. Additionally, reviewing the .gitmodules file for any suspicious URLs before executing commands can help mitigate the risk.
Conclusion
The CVE-2017-1000117 vulnerability in the Git package poses a significant risk of remote code execution through malicious SSH URLs. Users are strongly advised to update their Git installations to the patched version 2.14.1-r0 to mitigate this risk. Additionally, employing safe practices when cloning repositories can further protect against exploitation.
See every vulnerability recorded for git →
FAQ
CVE-2017-1000117 is a vulnerability in the Git package that allows remote code execution through malicious SSH URLs.
If you are using a version of Git prior to 2.14.1-r0 on Alpine Linux, you are at risk. Check your version with 'git --version'.
If you suspect exploitation, immediately update your Git installation and review your system for any unauthorized changes or installations.
Yes, Vulert can monitor your application for open-source vulnerabilities using just a manifest file like package-lock.json, providing real-time alerts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
