Git remenda uma vulnerabilidade RCE crítica

O GitHub remenda uma vulnerabilidade classificada como crítica de execução arbitrária de código (RCE).

O Git abordou uma vulnerabilidade crítica de execução remota de código (RCE) no cliente de linha de comandos do Git, Git Desktop e Atom.

A falha foi identificada com o CVE-2018-17456, e podia ser explorada via repositórios maliciosos de forma a executar comandos remotos sobre um sistema vulnerável.

Repositórios maliciosos podem criar um ficheiro denominado .gitmodules que pode conter uma URL que começa com um traço.

O uso de um traço quando o Git clona um repositório usando o argumento –recurse-submodules, acionará o comando para interpretar a URL, possibilitando que um invasor execute código remoto no computador.

“When running “git clone –recurse-submodules”, Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a “git clone” subprocess. If the URL field is set to a string that begins with a dash, this “git clone” subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran “git clone”.”
“In addition to fixing the security issue for the user running “clone”, the 2.17.2, 2.18.1 and 2.19.1 releases have an “fsck” check which can be used to detect such malicious repository content when fetching or accepting a push. See “transfer.fsckObjects” in git-config(1).”

Essa falha foi resolvida no Git v2.19.1, no GitHub Desktop 1.4.2, no Github Desktop 1.4.3-beta0, no Atom 1.31.2 e no Atom 1.32.0-beta3.

Users have to upgrade their installs to the latest version of the Git client, Github Desktop, or Atom.

Pedro Tavares

Pedro Tavares is a professional in the field of information security working as an Ethical Hacker/Pentester, Malware Researcher and also a Security Evangelist. He is also a founding member at CSIRT.UBI and Editor-in-Chief of the security computer blog seguranca-informatica.pt.

In recent years he has invested in the field of information security, exploring and analyzing a wide range of topics, such as pentesting (Kali Linux), malware, exploitation, hacking, IoT and security in Active Directory networks. He is also Freelance Writer (Infosec. Resources Institute and Cyber Defense Magazine) and developer of the 0xSI_f33d – a feed that compiles phishing and malware campaigns targeting Portuguese citizens.