CVE-2023-40590
📋 TL;DR
GitPython on Windows systems can execute malicious git binaries from the current working directory instead of the system PATH, allowing arbitrary command execution. This affects Windows users who run GitPython from untrusted repositories. Linux and other OS are not vulnerable.
💻 Affected Systems
- GitPython
📦 What is this software?
Gitpython by Gitpython Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary command execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or execution of malicious scripts when users run GitPython from untrusted repositories containing malicious git executables.
If Mitigated
No impact if proper mitigations are implemented, such as setting GIT_PYTHON_GIT_EXECUTABLE environment variable or avoiding untrusted repositories.
🎯 Exploit Status
Exploitation requires user to run GitPython from a directory containing malicious git executable. Social engineering or supply chain attacks could deliver such repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4
Restart Required: No
Instructions:
No official patch available. Apply workarounds and mitigations instead.
🔧 Temporary Workarounds
Set GIT_PYTHON_GIT_EXECUTABLE environment variable
windowsForce GitPython to use a specific git executable path instead of searching current directory
setx GIT_PYTHON_GIT_EXECUTABLE "C:\Program Files\Git\cmd\git.EXE"
Use absolute git path in code
windowsExplicitly set git executable path in Python code
import git
repo = git.Repo('.', git_executable='C:\\Program Files\\Git\\cmd\\git.EXE')
🧯 If You Can't Patch
- Never run GitPython from untrusted repositories or directories
- Implement strict access controls on repository sources and verify repository integrity
🔍 How to Verify
Check if Vulnerable:
Check if using GitPython on Windows without GIT_PYTHON_GIT_EXECUTABLE environment variable setCheck Version:
pip show GitPython | findstr VersionVerify Fix Applied:
Verify GIT_PYTHON_GIT_EXECUTABLE is set to absolute path and test with malicious git.exe in CWD📡 Detection & Monitoring
Log Indicators:
- Unexpected git.exe execution from non-standard paths
- GitPython processes spawning from user directories
Network Indicators:
- Unusual outbound connections from git processes
SIEM Query:
Process creation where (Image contains 'git.exe' AND NOT (Image contains 'Program Files\\Git')) OR (ParentImage contains 'python.exe' AND CommandLine contains 'git')🔗 References
- https://docs.python.org/3/library/subprocess.html#popen-constructor
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4
- https://docs.python.org/3/library/subprocess.html#popen-constructor
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4
