CVE-2021-21237: Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
Summary
CVE-2021-21237: Arbitrary code execution on Windows in github.com/git-lfs/git-lfs. Affects github.com/git-lfs/git-lfs versions < 1.5.1-0.20210113180018-fc664697ed2c. Fixed in 1.5.1-0.20210113180018-fc664697ed2c. How to fix ↓
Also tracked for
- git-lfs · Bitnami
The same CVE-2021-21237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/git-lfs/git-lfs is a Go package that provides Git Large File Storage (LFS) functionality. It is used for managing large files in Git repositories. Git LFS replaces large files with text pointers, improving performance and reducing repository size. However, a vulnerability in the package allows for arbitrary code execution on Windows systems when cloning or operating on untrusted Git repositories.
Vulnerability Detail
The vulnerability (CVE-2021-21237) arises due to the behavior of exec.LookPath in the standard library on Windows. This behavior can be exploited by malicious actors to execute arbitrary code. When interacting with untrusted Git repositories, various methods within the package may trigger this vulnerability. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code on the affected Windows system.
How To Fix
Minimum fixed version
1.5.1-0.20210113180018-fc664697ed2c
This is the first release that contains the fix.
go get github.com/git-lfs/git-lfs@v1.5.1-0.20210113180018-fc664697ed2cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to update the package to the fixed version as soon as possible to mitigate the risk of arbitrary code execution.
Conclusion
The vulnerability (CVE-2021-21237) in the github.com/git-lfs/git-lfs package allows for arbitrary code execution on Windows systems when interacting with untrusted Git repositories. To mitigate this risk, it is crucial to update the package to version 1.5.1-0.20210113180018-fc664697ed2c or later. This fix ensures that the vulnerability is patched and the system is protected. For additional support and guidance, please contact DevNack.com.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
The vulnerability allows for arbitrary code execution on Windows systems when interacting with untrusted Git repositories. This can lead to unauthorized access, data breaches, and potential system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
At the time of this report, there are no known public exploits for this vulnerability. However, it is essential to update the package to the fixed version to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious Git repository and trick a user into cloning or operating on it, leading to arbitrary code execution on the user's Windows system.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
