CVE-2024-52006
📋 TL;DR
This vulnerability allows attackers to inject malicious commands into Git credential helpers by exploiting how some ecosystems interpret carriage return characters as newlines. It affects users of Git with credential helpers in .NET or Node.js ecosystems. The vulnerability bypasses previous protections from CVE-2020-5260.
💻 Affected Systems
- Git
- Git credential helpers in .NET ecosystem
- Git credential helpers in Node.js ecosystem
📦 What is this software?
Git by Git
Git by Git
Git by Git
Git by Git
Git by Git
Git by Git
Git by Git
Git by Git
Git by Git
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, credential theft, and lateral movement within the environment.
Likely Case
Credential theft from Git credential helpers, potentially exposing sensitive authentication tokens and passwords.
If Mitigated
Limited impact with proper network segmentation and restricted Git operations from untrusted sources.
🎯 Exploit Status
Exploitation requires social engineering or tricking users into cloning from malicious repositories. The vulnerability bypasses previous fixes for similar issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, v2.40.4
Vendor Advisory: https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
Restart Required: No
Instructions:
1. Check current Git version with 'git --version'. 2. Upgrade Git using your package manager (apt, yum, brew, etc.) or download from git-scm.com. 3. Verify upgrade with 'git --version' again.
🔧 Temporary Workarounds
Avoid untrusted Git operations
allPrevent exploitation by restricting Git operations to trusted sources only
🧯 If You Can't Patch
- Avoid cloning from untrusted URLs, especially recursive clones
- Implement network segmentation to isolate Git operations from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Run 'git --version' and compare against patched versions. If version is older than listed patched versions, system is vulnerable.Check Version:
git --versionVerify Fix Applied:
Run 'git --version' and confirm version matches or exceeds v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, or v2.40.4📡 Detection & Monitoring
Log Indicators:
- Unusual Git clone operations from unfamiliar URLs
- Failed credential helper executions
- Unexpected process spawns from Git operations
Network Indicators:
- Git protocol traffic to suspicious or unknown repositories
- Unusual outbound connections following Git operations
SIEM Query:
Process creation where parent process is git and command line contains suspicious parameters or URLs🔗 References
- https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g
- https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060
- https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
- https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp
- https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html
