CVE-2025-21613
📋 TL;DR
An argument injection vulnerability in go-git versions before 5.13.0 allows attackers to set arbitrary values to git-upload-pack flags when using the file transport protocol. This affects applications using go-git library with file protocol transport, potentially enabling remote code execution. Only systems using go-git's file transport protocol are vulnerable.
💻 Affected Systems
- go-git library
📦 What is this software?
Go Git by Go Git Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on the server hosting the go-git repository, allowing complete system compromise and data exfiltration.
Likely Case
Arbitrary command execution with the privileges of the go-git process, potentially leading to data manipulation or lateral movement.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are followed, restricting the blast radius.
🎯 Exploit Status
Exploitation requires the attacker to control input that gets passed to git-upload-pack via file protocol. No authentication needed if the vulnerable endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.13.0
Vendor Advisory: https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m
Restart Required: Yes
Instructions:
1. Update go-git dependency to version 5.13.0 or later. 2. Run 'go mod tidy' to update go.mod. 3. Rebuild and redeploy affected applications. 4. Restart services using the updated library.
🔧 Temporary Workarounds
Disable file transport protocol
allPrevent use of file:// URLs in go-git operations
Configure application to use SSH, HTTP, or Git protocols only
Network segmentation
allRestrict network access to systems using go-git file protocol
Implement firewall rules to block external access to file protocol endpoints
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all git operations
- Run go-git processes with minimal privileges and in isolated containers
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for go-git version below 5.13.0Check Version:
grep 'github.com/go-git/go-git' go.modVerify Fix Applied:
Verify go.mod contains 'github.com/go-git/go-git/v5 v5.13.0' or higher📡 Detection & Monitoring
Log Indicators:
- Unusual git-upload-pack commands with unexpected flags
- File protocol usage from unexpected sources
Network Indicators:
- File protocol git operations to internal systems
SIEM Query:
source="application.logs" AND "git-upload-pack" AND "file://" AND (unusual_flag OR injection_pattern)