Arbitrary Code Execution in git-sizer
Summary
GHSA-57q7-rxqq-7vgp: On Windows, git-sizer might run a git executable within the repository being analyzed. Affects github.com/github/git-sizer versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
git-sizer is a tool written in Go that analyzes the size of Git repositories. It provides insights into the distribution of file sizes, the number of revisions, and other metrics. The tool is commonly used to identify potential performance issues and optimize repository size. However, a vulnerability has been discovered in git-sizer on Windows platforms that could allow an attacker to execute arbitrary code.
Vulnerability Detail
The vulnerability arises when git-sizer is run against a non-bare repository on Windows and the repository contains an executable file named git.exe or git.bat. In such cases, git-sizer may inadvertently execute the repository's executable file instead of the system's git executable. This could be exploited by an attacker through social engineering to trick a victim into running git-sizer against a malicious repository, leading to the execution of arbitrary code. While a similar issue could occur on Linux or Unix-based systems, it is less likely due to the uncommon configuration of having the current directory before the path to the standard git executable.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
go get github.com/github/git-sizer@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating git-sizer is not immediately feasible, users on Windows can employ the following workarounds:
- Avoid running git-sizer against repositories that may contain hostile code.
- If necessary, run git-sizer against a bare clone of the repository.
- Ensure that the repository being analyzed does not have an executable file in its top-level directory before running git-sizer.
On Linux or Unix-based systems, it is recommended to avoid adding the current directory to the PATH environment variable to minimize the risk of similar issues.
Conclusion
The vulnerability in git-sizer on Windows platforms could allow for arbitrary code execution when running git-sizer against a non-bare repository. To address this issue, users should update to git-sizer version 1.4.0 or later. Alternatively, certain workarounds can be employed to minimize the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/github/git-sizer →
FAQ
git-sizer is a tool used to analyze the size of Git repositories, providing insights into file distribution and revision metrics.
The vulnerability occurs when git-sizer is run against a non-bare repository on Windows and the repository contains an executable file named git.exe or git.bat. In such cases, git-sizer may inadvertently execute the repository's executable file instead of the system's git executable.
The vulnerability could allow an attacker to execute arbitrary code by tricking a victim into running git-sizer against a malicious repository.
While a similar issue could occur on Linux or Unix-based systems, it is less likely due to the uncommon configuration of having the current directory before the path to the standard git executable.
Users should update to git-sizer version 1.4.0 or later to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/github/git-sizer.
