CVE-2022-24975
📋 TL;DR
CVE-2022-24975 (GitBleed) is a documentation issue where Git's --mirror clone option documentation doesn't mention that deleted content remains accessible. This could lead to information disclosure if security audits rely on regular clones instead of mirror clones. Organizations using Git for sensitive repositories are affected.
💻 Affected Systems
- Git
📦 What is this software?
Git by Git Scm
⚠️ Risk & Real-World Impact
Worst Case
Attackers could recover deleted sensitive data (secrets, credentials, proprietary code) from Git repositories that were thought to be securely deleted, leading to data breaches.
Likely Case
Accidental exposure of deleted content during repository audits or migrations, potentially revealing outdated secrets or internal information.
If Mitigated
Minimal impact if organizations use proper Git hygiene practices and security controls for repository management.
🎯 Exploit Status
Exploitation requires repository access and knowledge of Git commands. This is more of an information disclosure risk than an active exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Git 2.35.2 and later
Vendor Advisory: https://github.com/git/git/security/advisories
Restart Required: No
Instructions:
1. Update Git to version 2.35.2 or later. 2. On Linux: Use package manager (apt-get upgrade git, yum update git, etc.). 3. On Windows: Download latest installer from git-scm.com. 4. On macOS: Use Homebrew (brew upgrade git).
🔧 Temporary Workarounds
Use --mirror for security audits
allAlways use 'git clone --mirror' when performing security audits or repository analysis to ensure deleted content is included.
git clone --mirror <repository-url>
Implement repository cleanup
allUse Git garbage collection and force-push to permanently remove sensitive deleted content.
git gc --aggressive --prune=now
git push --force
🧯 If You Can't Patch
- Train developers and security teams to always use 'git clone --mirror' for security audits and repository analysis
- Implement repository scanning tools that check for exposed secrets in Git history and enforce cleanup procedures
🔍 How to Verify
Check if Vulnerable:
Check if Git version is 2.35.1 or earlier and if documentation doesn't mention --mirror includes deleted contentCheck Version:
git --versionVerify Fix Applied:
Verify Git version is 2.35.2 or later and documentation has been updated📡 Detection & Monitoring
Log Indicators:
- Unusual git clone patterns, especially without --mirror flag for security audits
- Repository access logs showing clones of sensitive repositories
Network Indicators:
- Git protocol traffic to sensitive repositories without proper authentication
SIEM Query:
source="git_logs" AND (command="clone" AND NOT command="clone --mirror") AND repository="sensitive_*"🔗 References
- https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191
- https://lore.kernel.org/git/xmqq4k14qe9g.fsf%40gitster.g/
- https://www.aquasec.com/blog/undetected-hard-code-secrets-expose-corporations/
- https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/
- https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191
- https://www.aquasec.com/blog/undetected-hard-code-secrets-expose-corporations/
- https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/
