GO-2021-0073

vendorUSosv

Arbitrary command execution in github.com/git-lfs/git-lfs

view advisory published 2021-04-14Licence: per source

Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This can be triggered by cloning a malicious repository.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-17831US	high8.8	3.68% (90th)	—	2017-12-21
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfs…

references

External citations — patches, advisories, analysis.

http://blog.recurity-labs.com/2017-08-10/scm-vulnsWEB
https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.htmlWEB
https://github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19FIX
https://github.com/git-lfs/git-lfs/pull/2241FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan