Credential Exfiltration Vulnerability in Git LFS
Summary
CVE-2024-53263: Git LFS permits exfiltration of credentials via crafted HTTP URLs. Affects github.com/git-lfs/git-lfs versions >= 0.1.0, <= 3.0.0. No fix is published. How to fix ↓
Also tracked for
The same CVE-2024-53263 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS (Large File Storage) is an extension for Git that allows users to manage large files efficiently. It replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. This functionality is crucial for developers who need to handle large assets without bloating their repositories. However, Git LFS has a critical vulnerability that allows attackers to exfiltrate user credentials through crafted HTTP URLs.
Vulnerability Detail
The vulnerability arises when Git LFS requests credentials from Git for a remote host. It passes parts of the host's URL to the 'git-credential' command without validating for embedded line-ending control characters. This oversight allows an attacker to insert URL-encoded control characters, such as line feed (LF) or carriage return (CR), into the URL. Consequently, any credentials returned by the Git credential helper can be sent back to the remote host, potentially exposing sensitive user information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The Git LFS vulnerability allows for the potential exfiltration of user credentials through crafted HTTP URLs. Users are strongly advised to upgrade to version 3.6.1 or later to protect against this risk. Regular monitoring and updates are essential to maintain security in open-source software.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
The impact includes potential exposure of sensitive Git credentials to attackers, which can lead to unauthorized access to repositories.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
Yes, upgrading to Git LFS version 3.6.1 or later resolves this vulnerability.
While there are no workarounds available, it is crucial to prioritize the upgrade to mitigate the risk of credential exposure.
More information can be found in the GitHub advisory at https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
