CVE-2024-53263: Git LFS Credential Exfiltration via Crafted HTTP URLs
Summary
CVE-2024-53263: Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs. Affects github.com/git-lfs/git-lfs versions >= 0.1.0. No fix is published. How to fix ↓
Also tracked for
The same CVE-2024-53263 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git LFS (Large File Storage) is an extension for Git that allows users to manage large files efficiently. It replaces large files in your repository with text pointers inside Git, while storing the file contents on a remote server. This functionality is crucial for developers working with large assets, such as media files or datasets. However, the package has been found to have a vulnerability that allows for the exfiltration of credentials through specially crafted HTTP URLs, potentially compromising user security.
Vulnerability Detail
The vulnerability arises from the way Git LFS processes HTTP URLs. An attacker can craft a malicious URL that, when accessed, can lead to the unintentional exposure of user credentials. This could result in unauthorized access to sensitive data or accounts. The vulnerability affects all versions of Git LFS starting from 0.1.0 and has been identified as a significant security risk, as it can be exploited without user consent.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid clicking on untrusted links or URLs that may be crafted to exploit this vulnerability. Additionally, consider using environment variables to manage sensitive credentials instead of hardcoding them in your application.
Conclusion
The Git LFS vulnerability (CVE-2024-53263) poses a significant risk by allowing credential exfiltration through crafted HTTP URLs. Users are strongly encouraged to update to version 3.6.1 or later to mitigate this risk. Additionally, practicing caution with untrusted links can help protect sensitive information.
See every vulnerability recorded for github.com/git-lfs/git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with lightweight pointers in the repository.
The vulnerability allows attackers to craft URLs that can exfiltrate your credentials when accessed, potentially leading to unauthorized access.
All versions starting from 0.1.0 are affected, with the vulnerability fixed in version 3.6.1 and later.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, avoid clicking on suspicious links and consider using environment variables for sensitive credentials.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/git-lfs/git-lfs.
