Remote Code Execution (RCE) Affecting gitpython package, versions [0,3.1.30)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
1.19% (86th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-GITPYTHON-3113858
- published 5 Dec 2022
- disclosed 13 Nov 2022
- credit Sam Wheating
Introduced: 13 Nov 2022
CVE-2022-24439 Open this link in a new tabHow to fix?
Upgrade GitPython to version 3.1.30 or higher.
Overview
GitPython is a python library used to interact with Git repositories
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. This is only relevant when enabling the ext transport protocol.
PoC
from git import Repo
r = Repo.init('', bare=True)
r.clone_from('ext::sh -c touch% /tmp/pwned', 'tmp', multi_options=["-c protocol.ext.allow=always"])
References
CVSS Scores
version 3.1