CVE-2022-24826
📋 TL;DR
This vulnerability allows arbitrary code execution on Windows systems when Git LFS processes malicious repositories. Attackers can trick Git LFS into executing malicious programs named with a leading dot (like ..exe) instead of legitimate executables. Only affects Windows users running Git LFS versions 2.12.1 through 3.1.2.
💻 Affected Systems
- Git LFS
📦 What is this software?
Git Large File Storage by Git Large File Storage Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution when processing malicious Git repositories, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or code execution when users clone or interact with malicious repositories, particularly in development environments.
If Mitigated
No impact if Git LFS is patched or if legitimate executables (git.exe, cygpath.exe) are properly found in PATH.
🎯 Exploit Status
Exploitation requires user interaction (cloning/processing malicious repo). The vulnerability details are publicly documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.3
Vendor Advisory: https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6rw3-3whw-jvjj
Restart Required: No
Instructions:
1. Download Git LFS 3.1.3 or later from https://github.com/git-lfs/git-lfs/releases
2. Run the installer to upgrade
3. Verify installation with 'git lfs version'
🔧 Temporary Workarounds
Ensure Git executables in PATH
windowsAdd legitimate git.exe and cygpath.exe to system PATH to prevent fallback to current directory execution.
setx PATH "%PATH%;C:\Path\To\Git\Bin"
setx PATH "%PATH%;C:\Path\To\Cygwin\Bin"
🧯 If You Can't Patch
- Avoid cloning untrusted Git repositories, especially on Windows systems
- Use Unix-based systems for Git operations when possible as they are not affected
🔍 How to Verify
Check if Vulnerable:
Check Git LFS version with 'git lfs version'. If version is between 2.12.1 and 3.1.2 inclusive, system is vulnerable.Check Version:
git lfs versionVerify Fix Applied:
Run 'git lfs version' and confirm version is 3.1.3 or higher.📡 Detection & Monitoring
Log Indicators:
- Failed execution attempts of git.exe or cygpath.exe from current directory
- Unexpected process execution with names starting with '..'
Network Indicators:
- Cloning from unknown or suspicious Git repositories
SIEM Query:
Process creation where command line contains '..exe' or parent process is git-lfs.exe