CVE-2021-21237: Vulnerability in git-lfs
Summary
CVE-2021-21237: Git LFS can execute a Git binary from the current directory on Windows. Affects git-lfs versions < 2.13.2. Fixed in 2.13.2. How to fix ↓
Also tracked for
The same CVE-2021-21237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS is a command line extension for managing large files with Git. It allows users to store large files outside the Git repository, reducing the size of the repository and improving performance. However, a vulnerability has been discovered in Git LFS on Windows systems. If Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, allowing an attacker to execute arbitrary code. This issue is a result of an incomplete fix for a previous vulnerability (CVE-2020-27955). It is important to note that this vulnerability only affects Windows systems, and Unix systems are not affected.
Vulnerability Detail
The vulnerability in Git LFS on Windows systems allows an attacker to execute arbitrary code by exploiting a malicious repository. When Git LFS encounters a git.bat or git.exe file in the current directory, it executes that program. This can be abused by an attacker to run any code they desire, potentially leading to remote code execution. The vulnerability is a result of Go's behavior on Windows, where it includes and prefers the current directory when the name of a command run does not contain a directory separator. The issue has been assigned CVE-2021-21237 and has a severity rating of High.
How To Fix
Minimum fixed version
2.13.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability other than avoiding untrusted repositories or using a different operating system. It is crucial to exercise caution when interacting with Git LFS repositories, especially on Windows systems. By updating to the latest version of Git LFS, users can mitigate the risk of this vulnerability.
Conclusion
The vulnerability in Git LFS on Windows systems allows for the execution of arbitrary code from malicious repositories. To mitigate this risk, it is crucial to update Git LFS to version 2.13.2 or later. By doing so, users can ensure their systems are protected against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is a command line extension for managing large files with Git. It allows users to store large files outside the Git repository, reducing the size of the repository and improving performance.
This vulnerability only affects Windows systems. Unix systems are not affected.
The vulnerability allows an attacker to execute arbitrary code by exploiting a malicious repository. This can lead to remote code execution and potential compromise of the affected system.
There is no known workaround for this vulnerability other than avoiding untrusted repositories or using a different operating system. Updating to the latest version of Git LFS is the recommended solution.
To fix this vulnerability, update Git LFS to version 2.13.2 or later. This version includes a complete fix for the vulnerability and prevents the execution of arbitrary code from malicious repositories.
References
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
