Critical Credential Exposure in Git LFS: CVE-2024-53263
Summary
CVE-2024-53263: Git LFS is a Git extension for versioning large files. Affects git-lfs across 3 version ranges.
< 2.13.2-1+deb11u1
< 0345b6f816e611d050c0df67b61f0022916a1c90
< ea47a34bde1ba1ecf9eb8dc6d44fcf7aef42f5e3
Fixed in 2.13.2-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS (Large File Storage) is a Git extension designed to manage large files efficiently within Git repositories. It allows users to version large files while keeping the repository lightweight. Git LFS is widely used in software development environments where large assets, such as images, videos, and datasets, are common. However, a vulnerability has been identified that could expose user credentials when interacting with remote hosts.
Vulnerability Detail
The vulnerability arises when Git LFS requests credentials from Git for a remote host. It improperly passes portions of the host's URL to the git-credential(1) command without validating for embedded line-ending control characters. An attacker can exploit this by inserting URL-encoded control characters, such as line feed (LF) or carriage return (CR), into the URL. This could lead to the retrieval of a user's Git credentials, posing a significant security risk.
How To Fix
Minimum fixed version
2.13.2-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The recommended action is to upgrade to the patched version as soon as possible.
Conclusion
CVE-2024-53263 represents a critical vulnerability in Git LFS that can expose user credentials through improper URL handling. Users are strongly advised to upgrade to version 3.6.1 or later to mitigate this risk. Continuous monitoring for vulnerabilities is essential to maintain security.
See every vulnerability recorded for git-lfs →
FAQ
CVE-2024-53263 is a vulnerability in Git LFS that allows attackers to potentially retrieve user credentials due to improper handling of URLs.
If you are using a version of Git LFS prior to 3.6.1, your system is vulnerable. You can check your version with the command git lfs version.
If you suspect that your credentials have been compromised, immediately change your Git credentials and upgrade Git LFS to the latest version.
Yes, tools like Vulert can monitor your projects for open-source vulnerabilities in real-time using a manifest file like package-lock.json.
You can find detailed information about CVE-2024-53263 on the official CVE database or by visiting the Git LFS repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
