Git for Windows's config file of `connect.exe` is susceptible to malicious placing

CVE-2023-29011

Summary

The vulnerability in Git for Windows involves a hard-coded location for the connect.exe config file, C:\etc\connectrc. This setup allows authenticated users on multi-user machines to place malicious files in this directory, potentially compromising the integrity of proxy connections. The vulnerability can be mitigated by upgrading to Git for Windows v2.40.1 or by implementing restrictive access controls on folders used by Git commands. Users should remain vigilant for unauthorized connectrc files in the etc directory.

References