CVE-2023-25815
Vulnerability from cvelistv5
Published
2023-04-25 19:51
Modified
2024-08-02 11:32
Severity ?
3.3 (Low) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L
Summary
Git looks for localized messages in the wrong place
References
security-advisories@github.comhttp://www.openwall.com/lists/oss-security/2023/04/25/2Mailing List, Third Party Advisory
security-advisories@github.comhttps://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stackProduct
security-advisories@github.comhttps://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1Release Notes
security-advisories@github.comhttps://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8Vendor Advisory
security-advisories@github.comhttps://github.com/msys2/MINGW-packages/pull/10461Issue Tracking, Patch
security-advisories@github.comhttps://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/Mailing List, Third Party Advisory
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/
security-advisories@github.comhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/Mailing List, Third Party Advisory
security-advisories@github.comhttps://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.htmlProduct
security-advisories@github.comhttps://security.gentoo.org/glsa/202312-15
Impacted products
git-for-windowsgit
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:32:12.304Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8"
          },
          {
            "name": "https://github.com/msys2/MINGW-packages/pull/10461",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/msys2/MINGW-packages/pull/10461"
          },
          {
            "name": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack"
          },
          {
            "name": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1"
          },
          {
            "name": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/04/25/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202312-15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git-for-windows",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.40.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function\u0027s implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\mingw64\\share\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\` (and since `C:\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.\n\nThis vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134: Use of Externally-Controlled Format String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-25T19:51:38.433Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8"
        },
        {
          "name": "https://github.com/msys2/MINGW-packages/pull/10461",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msys2/MINGW-packages/pull/10461"
        },
        {
          "name": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack"
        },
        {
          "name": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1"
        },
        {
          "name": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/04/25/2"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202312-15"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
        }
      ],
      "source": {
        "advisory": "GHSA-9w66-8mq8-5vm8",
        "discovery": "UNKNOWN"
      },
      "title": "Git looks for localized messages in the wrong place"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-25815",
    "datePublished": "2023-04-25T19:51:38.433Z",
    "dateReserved": "2023-02-15T16:34:48.773Z",
    "dateUpdated": "2024-08-02T11:32:12.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-25815\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-04-25T20:15:09.997\",\"lastModified\":\"2024-06-26T10:15:11.530\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function\u0027s implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\\\mingw64\\\\share\\\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\\\` (and since `C:\\\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.\\n\\nThis vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\\\`.\"},{\"lang\":\"es\",\"value\":\"En Git para Windows, la versi\u00f3n de Git para Windows, no se env\u00edan mensajes localizados con el instalador. Como consecuencia, se espera que Git no localice ning\u00fan mensaje y omita la inicializaci\u00f3n de gettext. Sin embargo, debido a un cambio en los paquetes MINGW, la inicializaci\u00f3n impl\u00edcita de la funci\u00f3n `gettext()` ya no usa el prefijo de tiempo de ejecuci\u00f3n sino que usa la ruta codificada `C:\\\\mingw64\\\\share\\\\locale` para buscar mensajes localizados. Y dado que cualquier usuario autenticado tiene permiso para crear carpetas en `C:\\\\` (y dado que `C:\\\\mingw64` normalmente no existe), es posible que los usuarios con pocos privilegios coloquen mensajes falsos en esa ubicaci\u00f3n donde `git .exe` los recoger\u00e1 en la versi\u00f3n 2.40.1. Esta vulnerabilidad es relativamente dif\u00edcil de explotar y requiere ingenier\u00eda social. Por ejemplo, un mensaje leg\u00edtimo al final de un clon podr\u00eda modificarse maliciosamente para pedirle al usuario que dirija su navegador web a un sitio web malicioso, y el usuario podr\u00eda pensar que el mensaje proviene de Git y es leg\u00edtimo. Sin embargo, requiere acceso de escritura local por parte del atacante, lo que hace que este vector de ataque sea menos probable. La versi\u00f3n 2.40.1 contiene un parche para este problema. Algunas soluciones est\u00e1n disponibles. No trabaje en una m\u00e1quina Windows con cuentas compartidas o, alternativamente, cree una carpeta `C:\\\\mingw64` y d\u00e9jela vac\u00eda. Los usuarios que tienen derechos administrativos pueden eliminar el permiso para crear carpetas en `C:\\\\`.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":2.2,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":0.8,\"impactScore\":1.4},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":0.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-134\"},{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-134\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:git_for_windows_project:git_for_windows:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.40.1\",\"matchCriteriaId\":\"E740B447-D96A-40C3-AFA9-9B058379E04D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2023/04/25/2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/msys2/MINGW-packages/pull/10461\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://security.gentoo.org/glsa/202312-15\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.