An even more devious attack is to ship a .git/config file with the core.fsmonitor option set to a malicious command. This command gets executed by many different git operations, including very basic ones like git status.
This is rather nasty because several other programs like to implicitly run git status, including IDEs, go build, and fancy shell prompt integrations that e.g. show the current branch. I disabled all of my git shell integrations and set GOFLAGS=-buildvcs=false after I learned about core.fsmonitor.
Note that git itself refuses to check out a .git directory from a remote repo so running git clone, git pull, etc. can never install a malicious config or hook, but if you install directory trees from any other source, like a tarball, a different VCS, or Dropbox (as in this article), you have to watch out for .git directories.
Damn! I wouldn’t have expected it to be so dangerous to clone a repository and perform basic operations on it. I really thought that this type of flow would have been safe.
As I said in my comment, cloning a repo cannot install malicious config. It’s the other ways of installing directory trees that you have to be wary of.
An even more devious attack is to ship a
.git/configfile with thecore.fsmonitoroption set to a malicious command. This command gets executed by many different git operations, including very basic ones likegit status.This is rather nasty because several other programs like to implicitly run
git status, including IDEs,go build, and fancy shell prompt integrations that e.g. show the current branch. I disabled all of my git shell integrations and setGOFLAGS=-buildvcs=falseafter I learned aboutcore.fsmonitor.Note that git itself refuses to check out a
.gitdirectory from a remote repo so runninggit clone,git pull, etc. can never install a malicious config or hook, but if you install directory trees from any other source, like a tarball, a different VCS, or Dropbox (as in this article), you have to watch out for.gitdirectories.score 1 · canonical
Damn! I wouldn’t have expected it to be so dangerous to clone a repository and perform basic operations on it. I really thought that this type of flow would have been safe.
score 1 · canonical
As I said in my comment, cloning a repo cannot install malicious config. It’s the other ways of installing directory trees that you have to be wary of.
score 1 · canonical
https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md
Running operations in a subdirectory can still own you unless you turn on an option that’s off by default. Specifically:
git clone ssh://git@host.example/helloworld.git cd helloworld git status # <-- Safe cd malicious_subdirectory git status # <-- Dangerousscore 1 · canonical
Ahhhh I see the distinction. If you clone it you’re fine, but if you e.g, download it from Dropbox, you get RCE. Tricky!
score 1 · canonical