Arbitrary configuration injection via `git submodule deinit`
CVE-2023-29007
Key Information:
Badges
What is CVE-2023-29007?
A vulnerability exists in Git where specially crafted .gitmodules files containing submodule URLs longer than 1024 characters can exploit a bug in the configuration handling. This allows attackers to inject arbitrary configuration settings into a user's $GIT_DIR/config. Particularly, these injected settings might specify executables to run, leading to potential remote code execution. To mitigate this risk, users should update to the latest versions of Git or ensure careful inspection of submodule sections before executing commands like git submodule deinit.
Affected Version(s)
git < 2.30.9 < 2.30.9
git >= 2.31.0, < 2.31.8 < 2.31.0, 2.31.8
git >= 2.32.0, < 2.32.7 < 2.32.0, 2.32.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.