TCP: Git Git Source Code Management clone_submodule Link Following

This signature detects attempts to exploit a known vulnerability against Git Source Code Management clone_submodule. A successful attack can lead to arbitrary code execution.

Extended Description

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

Affected Products

Git git

References

CVE: CVE-2024-32002

Short Name

TCP:GIT-SRC-SM-LNK-FWLG

Severity

Minor

Recommended

False

Recommended Action

Drop

TCP: Git Git Source Code Management clone_submodule Link Following

Extended Description

Affected Products

References

Found a potential security threat?