CVE-2023-23618
📋 TL;DR
CVE-2023-23618 is a path traversal vulnerability in Git for Windows where the gitk tool can inadvertently execute malicious executables from the current directory. This affects Windows users running gitk or Git GUI's 'Visualize History' functionality in untrusted repositories. Attackers can exploit this through social engineering to trick users into running arbitrary code.
💻 Affected Systems
- Git for Windows
📦 What is this software?
Git For Windows by Git For Windows Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware execution in user context when opening malicious repositories.
If Mitigated
No impact if gitk is avoided or patched version is used.
🎯 Exploit Status
Exploitation requires social engineering to get user to clone and use gitk on malicious repository. Proof of concept exists in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.39.2.windows.1
Vendor Advisory: https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm
Restart Required: No
Instructions:
1. Download Git for Windows 2.39.2 or later from https://gitforwindows.org/ 2. Run installer 3. Select 'Overwrite existing installation' 4. Complete installation wizard
🔧 Temporary Workarounds
Avoid gitk in untrusted repositories
windowsDo not use gitk or Git GUI's 'Visualize History' feature when working with repositories from untrusted sources.
🧯 If You Can't Patch
- Disable or remove gitk executable from system PATH
- Implement policy prohibiting gitk usage with external repositories
🔍 How to Verify
Check if Vulnerable:
Check Git for Windows version: git --version. If version is below 2.39.2, system is vulnerable.Check Version:
git --versionVerify Fix Applied:
Run git --version and confirm output shows 2.39.2 or higher.📡 Detection & Monitoring
Log Indicators:
- Process execution of unexpected executables from git repository directories
- gitk.exe spawning unusual child processes
Network Indicators:
- Unusual outbound connections following gitk execution
SIEM Query:
Process Creation where (Image contains 'gitk.exe' OR ParentImage contains 'gitk.exe') AND CommandLine contains current directory references🔗 References
- https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c
- https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1
- https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm
- https://wiki.tcl-lang.org/page/exec
- https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c
- https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1
- https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm
- https://wiki.tcl-lang.org/page/exec
