RubySec

Providing security resources for the Ruby community

CVE-2015-8968 (git-fastclone): git-fastclone permits arbitrary shell command execution from .gitmodules

ADVISORIES

GEM

git-fastclone

SEVERITY

CVSS v3.x: 8.8 (High)

PATCHED VERSIONS

  • >= 1.0.1

DESCRIPTION

Git allows executing arbitrary shell commands using git-remote-ext via a remote URLs. Normally git never requests URLs that the user doesn't specifically request, so this is not a serious security concern. However, submodules did allow the remote repository to specify what URL to clone from.

If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.