ADVISORIES
GEM
SEVERITY
CVSS v3.x: 8.8 (High)
PATCHED VERSIONS
- >= 1.0.1
DESCRIPTION
Git allows executing arbitrary shell commands using git-remote-ext via a remote URLs. Normally git never requests URLs that the user doesn’t specifically request, so this is not a serious security concern. However, submodules did allow the remote repository to specify what URL to clone from.
If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.