CVE-2017-17831 GitHub Git LFS Arbitrary command execution vulnerability

What is CVE-2017-17831?

CVE-2017-17831 is a high-severity command injection vulnerability in n/a, published on 21 Dec 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

Weakness: CWE-20

Which versions are affected by CVE-2017-17831?

3 open source packages ship an affected version, including github.com/git-lfs/git-lfs. It affects 1 product.

Products include Git Large File Storage Project Git Large File Storage.

How do I fix CVE-2017-17831?

Upgrade github.com/git-lfs/git-lfs to a fixed version for your release line: 2.1.1-0.20170519163204-f913f5f9c7c6 or 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-17831 being exploited?

There is no known exploitation of CVE-2017-17831 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-24826 Git LFS can execute a binary from the current directory on Windows Critical 9.8
• CVE-2020-27955 Git LFS can execute a Git binary from the current directory Critical 9.8
• CVE-2021-21237 Git LFS can execute a Git binary from the current directory on Windows High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w4xh-w33p-4v29, GO-2021-0073.