{"uuid": "938af3fa-91a3-4864-ace4-1cccf327ce66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/99459", "content": "https://external-preview.redd.it/gV4Noo60pixEn1crBPMSCwqitM9E5qnaJstNqsHXHjg.jpg?width=640&crop=smart&auto=webp&s=89e5ab881d2574c516cca27bb5aa59b4a986c942 Hello all,\n\nWanted to share more about a recent CVE (CVE-2023-29007) we've found. It has been assigned a CVSS score of 7.0/10 (high). I believe it might be useful to share this with you.\n\nGit\u2019s implementation used to rename or delete sections of a configuration file contained a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections.\n\nWhen attempting to rename or remove a malicious configuration section, this can result in arbitrary configuration injection into a user\u2019s .git/config. This may be used to achieve arbitrary code execution via configuration values that specify executables, such as core.pager, core.editor, and core.sshCommand.\n\nThis vulnerability may be exploited by using overly-long submodule URLs, which are stored in a user\u2019s .git/config upon initialization. Those URLs may be misinterpreted as containing new configuration material when removing those sections, for example, with git submodule deinit.\n\nExploiting this issue can be complex since it requires user interaction via legitimate git commands.\n\nSources:\n\nhttps://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/\n\nhttps://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844\n\nIntro\n\nAt Ethiack, we rely on git submodules to share common code across multiple components. We realized a weird behaviour on Github itself, with submodule URLs that would crash the GitHub repository page, while doing bug bounties on HackerOne\n\nThen, we dived into the git code base and started fuzzing it. We didn\u2019t get any crashes, but after a while, we realized that deinitializing submodules would somehow create new sections in .git/config.\n\nThe Vulnerability \n\nIn config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):In config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):\n\n\u200b\n\nhttps://preview.redd.it/w9sfmfcqnawa1.png?width=2048&format=png&auto=webp&s=f9439f62bcd355e6fe07393c6ce501fbd4f3cbe4\n\nNotice the:\n\n/* it's a section */\n\nWell... what if it's not a section? :)\n\nWhen we have a config file line larger than 1024 characters, fgets will be called one more time, even if there\u2019s no new line in the config file. If the first character of the buffer, or the first character after space characters is a \u2018[\u2018 character, a new section will be created in .git/config if the original section is being removed or renamed.\nThis means that any section variable larger than 1024 bytes that satisfies these conditions and is[...]", "creation_timestamp": "2026-09-05T01:00:25.220769Z"}