CVE-2014-9390 – This vulnerability allows malicious Git servers... (How to Fix)

Q: How do I fix CVE-2014-9390?

1. Update Git: 'git update-git-for-windows' (Windows) or 'brew upgrade git' (OS X). 2. Update Mercurial: 'pip install --upgrade mercurial'. 3. Update Xcode via App Store. 4. Update other affected tools to versions after 08-12-2014.

Q: What is the severity of CVE-2014-9390?

CVE-2014-9390 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows malicious Git servers to execute arbitrary commands on client systems when users clone or pull from repositories. It affects multiple Git implementations and related tools on Windows and OS X systems through crafted .git/config files that exploit case-insensitive filesystem handling. Users of affected Git, Mercurial, Xcode, and related tools are vulnerable.

📋 TL;DR

This vulnerability allows malicious Git servers to execute arbitrary commands on client systems when users clone or pull from repositories. It affects multiple Git implementations and related tools on Windows and OS X systems through crafted .git/config files that exploit case-insensitive filesystem handling. Users of affected Git, Mercurial, Xcode, and related tools are vulnerable.

💻 Affected Systems

Products:

Git
Mercurial
Apple Xcode
mine
libgit2
Egit
JGit

Versions: Git: <1.8.5.6, 1.9.x <1.9.5, 2.0.x <2.0.5, 2.1.x <2.1.4, 2.2.x <2.2.1; Mercurial: <3.2.3; Xcode: <6.2 beta 3; mine, libgit2, Egit, JGit: all versions before 08-12-2014

Operating Systems: Windows, OS X

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with case-insensitive filesystems (NTFS on Windows, HFS+ on OS X). Linux systems are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with full system compromise when cloning from a malicious repository, potentially leading to complete system takeover, data theft, and lateral movement.

🟠

Likely Case

Attackers create malicious repositories that execute arbitrary commands when developers clone them, leading to credential theft, backdoor installation, or data exfiltration.

🟢

If Mitigated

With proper network segmentation and developer awareness, impact limited to isolated development environments without access to production systems.

🌐 Internet-Facing: HIGH - Attackers can host malicious repositories on public platforms like GitHub, making exploitation trivial for unaware users.

🏢 Internal Only: MEDIUM - Internal Git servers could be compromised to attack developers, but requires initial internal foothold.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires users to clone/pull from malicious repositories. Public proof-of-concept repositories exist demonstrating the attack.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Git: 1.8.5.6, 1.9.5, 2.0.5, 2.1.4, 2.2.1; Mercurial: 3.2.3; Xcode: 6.2 beta 3; others: versions after 08-12-2014

Vendor Advisory: http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html

Restart Required: No

Instructions:

1. Update Git: 'git update-git-for-windows' (Windows) or 'brew upgrade git' (OS X). 2. Update Mercurial: 'pip install --upgrade mercurial'. 3. Update Xcode via App Store. 4. Update other affected tools to versions after 08-12-2014.

🔧 Temporary Workarounds

Use case-sensitive filesystem

osx

Configure Git to use case-sensitive mode on OS X or use Linux development environments

git config core.ignorecase false

Restrict repository sources

all

Only clone from trusted repositories and verify repository integrity before cloning

🧯 If You Can't Patch

Isolate development environments from production networks
Implement application whitelisting to prevent unauthorized command execution

🔍 How to Verify

Check if Vulnerable:

Check Git version: 'git --version'. If version matches affected ranges and OS is Windows/OS X, system is vulnerable.

Check Version:

git --version

Verify Fix Applied:

Verify Git version is patched: 'git --version' should show 1.8.5.6+, 1.9.5+, 2.0.5+, 2.1.4+, or 2.2.1+.

📡 Detection & Monitoring

Log Indicators:

Unusual command execution during git clone/pull operations
Creation of unexpected .git/config files with special characters

Network Indicators:

Git clone operations from unknown/untrusted repositories
Unusual outbound connections after git operations

SIEM Query:

process:git AND (command:clone OR command:pull) AND (destination_ip NOT IN trusted_repos)

📊 Metadata

CVE ID: CVE-2014-9390

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-20

Published: February 12, 2020

Last Updated: November 21, 2024

🔗 References

http://article.gmane.org/gmane.linux.kernel/1853266 Broken Link
http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html Third Party Advisory
http://mercurial.selenic.com/wiki/WhatsNew Release Notes,Third Party Advisory
http://securitytracker.com/id?1031404 Third Party Advisory,VDB Entry
http://support.apple.com/kb/HT204147 Vendor Advisory
https://github.com/blog/1938-git-client-vulnerability-announced Vendor Advisory
https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915 Third Party Advisory
https://libgit2.org/security/ Product
https://news.ycombinator.com/item?id=8769667 Issue Tracking,Patch,Third Party Advisory
http://article.gmane.org/gmane.linux.kernel/1853266 Broken Link
http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html Third Party Advisory
http://mercurial.selenic.com/wiki/WhatsNew Release Notes,Third Party Advisory
http://securitytracker.com/id?1031404 Third Party Advisory,VDB Entry
http://support.apple.com/kb/HT204147 Vendor Advisory
https://github.com/blog/1938-git-client-vulnerability-announced Vendor Advisory
https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915 Third Party Advisory
https://libgit2.org/security/ Product
https://news.ycombinator.com/item?id=8769667 Issue Tracking,Patch,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2014-9390, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Egit by Eclipse

Git by Git Scm

Git by Git Scm

Git by Git Scm

Git by Git Scm

Git by Git Scm

Jgit by Eclipse

Jgit by Eclipse

Libgit2 by Libgit2

Mercurial by Mercurial

Xcode by Apple

Xcode by Apple

Xcode by Apple

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Use case-sensitive filesystem

Restrict repository sources

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities