CVE-2021-21300 - Improper Link Resolution Before File Access ('Link Following')

Severity

75%

Complexity

16%

Confidentiality

98%

Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6.

CVSS 3.1 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 5.1. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:P).

Overview

First reported 3 years ago

2021-03-09 20:15:00

Last updated 3 years ago

2021-09-23 12:45:00

Affected Software

Fedora 32

32

References

[oss-security] 20210309 git: malicious repositories can execute remote code while cloning

https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592

https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm

https://git-scm.com/docs/gitattributes#_filter

https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks

https://lore.kernel.org/git/[email protected]/

FEDORA-2021-63fcbd126e

FEDORA-2021-ffd0b2108d

[oss-security] 20210309 git: malicious repositories can execute remote code while cloning

Exploit, Mailing List, Third Party Advisory

https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592

Patch, Third Party Advisory

https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm

Third Party Advisory

https://git-scm.com/docs/gitattributes#_filter

Vendor Advisory

https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks

Vendor Advisory

FEDORA-2021-63fcbd126e

Third Party Advisory

FEDORA-2021-ffd0b2108d

Third Party Advisory

https://lore.kernel.org/git/[email protected]/

Release Notes, Third Party Advisory

FEDORA-2021-03e61a6647

FEDORA-2021-03e61a6647

Mailing List, Third Party Advisory

FEDORA-2021-ffd0b2108d

Mailing List, Third Party Advisory

https://support.apple.com/kb/HT212320

https://support.apple.com/kb/HT212320

Third Party Advisory

20210427 APPLE-SA-2021-04-26-10 Xcode 12.5

GLSA-202104-01

20210427 APPLE-SA-2021-04-26-10 Xcode 12.5

Mailing List, Third Party Advisory

GLSA-202104-01

Third Party Advisory

http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html

http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html

Exploit, Third Party Advisory, VDB Entry

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.