{"uuid": "72a7ef1f-65e2-40fa-9588-340875f04749", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24765", "type": "seen", "source": "https://t.me/hacking_Attack/49880", "content": "Black Hat Ethical Hacking\nGit security vulnerabilities prompt updates\n\nGit security vulnerabilities prompt updatesPost Views: 3 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 1 Minute\nSoftware developers are advised to upgrade their systems to\u00a0Git v2.35.2\u00a0in order to guard against potential attacks, which would rely on an attacker first gaining write access on a targeted system.\nIt\u2019s time for developers to update their local Git installations following the discovery of a brace of vulnerabilities.\n\nThe worst of the two flaws (CVE-2022-24765) carries the potential of allowing an attacker to execute arbitrary commands.\n\nDevelopers using Git for Windows or Git on a multi-user machine are most at risk, as an advisory by GitHub\u00a0explains:\n\nThis vulnerability affects users working on multi-user machines where a malicious actor could create a .git\u00a0directory in a shared location above a victim\u2019s current working directory. On Windows, for example, an attacker could create C:\\.git\\config, which would cause all git invocations that occur outside of a repository to read its configured values.\n\nSince some configuration variables (such as core.fsmonitor) cause Git to execute arbitrary commands, this can lead to arbitrary command execution when working on a shared machine.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nDevelopers who use Git on Linux\u00a0or macOS are also affected by the CVE-2022-24765 flaw, albeit to a lesser extent. Patching in all cases is the recommended course of action but short of this, various mitigations are available, as detailed in GitHub\u2019s advisory.\n\nA second vulnerability (CVE-2022-24767) is limited to the Git for Windows uninstaller. As with the previous flaw, some level of compromised access is a prerequisite to potential attacks, as GitHub\u2019s advisory explains.\n\nAttacks would rely on planting malicious .dll\u00a0files on a targeted system.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Users are advised to update to Git for Windows v2.35.2\u00a0but, again, a number of temporary mitigations offer a viable alternative.\n\nCredit for discovering the vulnerability was given to Lockheed Martin\u2019s red team. GitHub\u00a0offers a centralized location for Git repositories, hence its role in flagging up the requirement for software updates. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload24 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-b[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T01:00:04.970215Z"}