O Git abordou uma vulnerabilidade crítica de execução remota de código (RCE) no cliente de linha de comandos do Git, Git Desktop e Atom.
A falha foi identificada com o CVE-2018-17456, e podia ser explorada via repositórios maliciosos de forma a executar comandos remotos sobre um sistema vulnerável.
“When running “git clone –recurse-submodules”, Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a “git clone” subprocess. If the URL field is set to a string that begins with a dash, this “git clone” subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran “git clone”.”
“In addition to fixing the security issue for the user running “clone”, the 2.17.2, 2.18.1 and 2.19.1 releases have an “fsck” check which can be used to detect such malicious repository content when fetching or accepting a push. See “transfer.fsckObjects” in git-config(1).”
Essa falha foi resolvida no Git v2.19.1, no GitHub Desktop 1.4.2, no Github Desktop 1.4.3-beta0, no Atom 1.31.2 e no Atom 1.32.0-beta3.
Users have to upgrade their installs to the latest version of the Git client, Github Desktop, or Atom.
Pedro Tavares is a professional in the field of information security working as an Ethical Hacker/Pentester, Malware Researcher and also a Security Evangelist. He is also a founding member at CSIRT.UBI and Editor-in-Chief of the security computer blog seguranca-informatica.pt.
In recent years he has invested in the field of information security, exploring and analyzing a wide range of topics, such as pentesting (Kali Linux), malware, exploitation, hacking, IoT and security in Active Directory networks. He is also Freelance Writer (Infosec. Resources Institute and Cyber Defense Magazine) and developer of the 0xSI_f33d – a feed that compiles phishing and malware campaigns targeting Portuguese citizens.
Read more here.