Git security vulnerability announced

Post by hsbauauvhabzb » Wed, Apr 13, 2022, 1:58 AM UTC

tedunangst wrote: post #5

eminence32 wrote: post #3

> Merely navigating to such a space with a Git-enabled `PS1` when there is a maliciously-crafted `/scratch/.git/` can lead to a compromised account. I'm curious about this -- what's the attack vector here?

.git/config sets fsmonitor to malware.exe and boom.

Post by [deleted] » Wed, Apr 13, 2022, 2:05 AM UTC

hsbauauvhabzb wrote: post #10

This is silly. Fix PS1, I can’t trust all repos I clone. I also want to cross-user access git log/blame etc.

Post by __turbobrew__ » Wed, Apr 13, 2022, 2:06 AM UTC

RayJSeth wrote: post #8

This certainly came as a surprise to my team today. We operate some number of repositories and the majority of them use https://github.com/actions-ecosystem/action-get-latest-tag - or more specifically, a fork of that repo which more or less works the same way. Midday today our CI/CD started failing. We must have hit this so soon because the `apk add git` in that Dockerfile grabbed the new git version. Evidently the…

Post by ddworken » Wed, Apr 13, 2022, 2:15 AM UTC

oauea wrote: post #12

hsbauauvhabzb wrote: post #11

Earlier quoted context omitted.

Can you do this to a GitHub hosted repo?

No, the .git directory is not cloned. But if the repo is already on disk it can be game over.

Post by carlosdp » Wed, Apr 13, 2022, 2:20 AM UTC

eminence32 wrote: post #3

> Merely navigating to such a space with a Git-enabled `PS1` when there is a maliciously-crafted `/scratch/.git/` can lead to a compromised account. I'm curious about this -- what's the attack vector here?