CVE-2022-24767
📋 TL;DR
This vulnerability allows attackers to perform DLL hijacking when the Git for Windows uninstaller runs under the SYSTEM user account. Attackers could execute arbitrary code with SYSTEM privileges by placing a malicious DLL in a location the uninstaller searches. This primarily affects Windows systems where Git for Windows is installed and the uninstaller might be executed with elevated privileges.
💻 Affected Systems
- Git for Windows
📦 What is this software?
Git For Windows by Git For Windows Project
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM-level compromise of the Windows machine, allowing complete control, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation to SYSTEM account on affected Windows machines, enabling persistence and further exploitation.
If Mitigated
Limited impact if proper access controls prevent unauthorized users from placing files in writable directories or executing the uninstaller with SYSTEM privileges.
🎯 Exploit Status
Exploitation requires local access and ability to place malicious DLL in writable directory that the uninstaller searches. The vulnerability is well-documented and simple to exploit given the right conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Git for Windows v2.35.2 and later
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767
Restart Required: No
Instructions:
1. Download Git for Windows v2.35.2 or later from https://gitforwindows.org/ 2. Run the installer to upgrade existing installation 3. No system restart required, but affected processes should be restarted
🔧 Temporary Workarounds
Restrict uninstaller execution
windowsPrevent execution of the Git for Windows uninstaller (unins000.exe) with SYSTEM privileges
File system permissions hardening
windowsSet restrictive permissions on directories where uninstaller searches for DLLs to prevent unauthorized file placement
🧯 If You Can't Patch
- Monitor for execution of unins000.exe with SYSTEM privileges and investigate any occurrences
- Implement application whitelisting to prevent execution of unins000.exe or restrict it to specific administrative contexts
🔍 How to Verify
Check if Vulnerable:
Check Git for Windows version: Open Git Bash and run 'git --version'. If version is earlier than 2.35.2, the system is vulnerable.Check Version:
git --versionVerify Fix Applied:
After updating, run 'git --version' and confirm version is 2.35.2 or later. Also verify unins000.exe file properties show updated version.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing unins000.exe execution with SYSTEM privileges
- Process creation events for unins000.exe with high integrity levels
Network Indicators:
- No network indicators - this is a local privilege escalation vulnerability
SIEM Query:
ProcessName="unins000.exe" AND IntegrityLevel="System" OR User="NT AUTHORITY\SYSTEM"