CVE-2024-53858: github.com/cli/cli - Recursive Repository Cloning Leaks Authentication Tokens
Summary
CVE-2024-53858: Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- gh · Debian:12
- github.com/cli/cli/v2 · Go
The same CVE-2024-53858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'github.com/cli/cli' package is a command-line interface for GitHub, enabling users to interact with GitHub repositories directly from the terminal. It provides functionalities such as creating issues, managing pull requests, and more. However, this package has a vulnerability that can expose sensitive authentication tokens when recursively cloning repositories that contain submodules hosted on non-GitHub platforms.
Vulnerability Detail
The vulnerability arises from the recursive cloning feature of the 'github.com/cli/cli' package. When a user clones a repository that includes submodules, the authentication tokens used for accessing the main repository can inadvertently be sent to non-GitHub submodule hosts. This can lead to unauthorized access to user accounts and sensitive data, as attackers could exploit these tokens to gain access to private repositories or perform actions on behalf of the user.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the recursive cloning feature when working with repositories that contain submodules. Instead, clone the main repository without the '--recursive' flag and manually initialize and update submodules as needed.
Conclusion
In summary, the vulnerability identified as CVE-2024-53858 in the 'github.com/cli/cli' package poses a significant risk by leaking authentication tokens during recursive repository cloning. Users are advised to update to version 2.63.0 or later to mitigate this risk and to consider workarounds if immediate updates are not feasible.
See every vulnerability recorded for github.com/cli/cli →
FAQ
The main issue is that authentication tokens can be leaked to non-GitHub submodule hosts during the cloning process, potentially compromising user accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package immediately, avoid using the recursive cloning feature and manually handle submodules to mitigate the risk.
Yes, the vulnerability affects all versions of 'github.com/cli/cli' prior to the fixed version 2.63.0.
The potential consequences include unauthorized access to private repositories and the ability for attackers to perform actions on behalf of the user.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
