Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

CVE-2023-4759

What is CVE-2023-4759?

A vulnerability in Eclipse JGit allows for an arbitrary file overwrite through symbolic links in specially crafted git repositories. When cloned or checked out on case-insensitive filesystems like those on Windows or macOS, this exploitation can permit writing files outside the working tree. This may lead to remote code execution if malicious files are executed in subsequent git operations. Users must have symbolic link creation rights for the vulnerability to be exploited. It is recommended to set the git configuration option 'core.symlinks' to false to mitigate the risk.

References