CVE-2024-22190
📋 TL;DR
GitPython versions before 3.1.41 on Windows are vulnerable to untrusted search path attacks when using shell execution for git commands or bash.exe for hooks. This allows attackers to execute malicious git.exe or bash.exe from untrusted repositories, potentially leading to arbitrary code execution. Users of GitPython on Windows who clone or interact with untrusted repositories are affected.
💻 Affected Systems
- GitPython
📦 What is this software?
Gitpython by Gitpython Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the GitPython process, potentially leading to full system compromise.
Likely Case
Arbitrary code execution when processing malicious repositories, leading to data theft, lateral movement, or persistence.
If Mitigated
Limited impact if proper access controls, sandboxing, and repository vetting are in place.
🎯 Exploit Status
Exploitation requires the victim to clone or interact with a malicious repository. The vulnerability is in the library's path resolution logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.41
Vendor Advisory: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx
Restart Required: No
Instructions:
1. Update GitPython to version 3.1.41 or later using pip: pip install --upgrade GitPython>=3.1.41
2. Verify the update with: pip show GitPython
3. No restart required, but restart any running applications using GitPython.
🔧 Temporary Workarounds
Avoid untrusted repositories
allOnly clone and interact with trusted Git repositories.
Use Linux/macOS for Git operations
allRun GitPython on non-Windows operating systems where this vulnerability does not exist.
🧯 If You Can't Patch
- Implement strict repository vetting processes and only allow trusted sources.
- Run GitPython in sandboxed environments with limited privileges and network access.
🔍 How to Verify
Check if Vulnerable:
Check if GitPython version is below 3.1.41 on Windows systems using: pip show GitPython | findstr VersionCheck Version:
pip show GitPython | findstr VersionVerify Fix Applied:
Confirm GitPython version is 3.1.41 or higher with: pip show GitPython | findstr Version📡 Detection & Monitoring
Log Indicators:
- Unusual git.exe or bash.exe execution from unexpected directories
- GitPython errors related to path resolution
Network Indicators:
- Git clone operations from untrusted or unknown repositories
SIEM Query:
Process creation where parent process is python.exe and command line contains git.exe or bash.exe from non-standard paths🔗 References
- https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7f
- https://github.com/gitpython-developers/GitPython/pull/1792
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx
- https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7f
- https://github.com/gitpython-developers/GitPython/pull/1792
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx
