CVE-2021-29468 Arbitrary code execution when checking out an attacker-controlled Git branch
Attackers can execute arbitrary code on Cygwin systems by tricking users into checking out a maliciously crafted Git repository containing specific symbolic links and filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-29468?
CVE-2021-29468 is a high-severity code injection vulnerability in me-and Cygwin-Git, published on 29 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The problem will be patched in the Cygwin Git v2.31.1-2 release. At time of writing, the vulnerability is present in the upstream Git source code; any Cygwin user who compiles Git for themselves from upstream sources should manually apply a patch to mitigate the vulnerability. As mitigation users should not clone or pull from repositories from untrusted sources. CVE-2019-1354 was an equivalent vulnerability in Git for Visual Studio.
Weakness: CWE-20
Which versions are affected by CVE-2021-29468?
It affects 1 product.
Products include Cygwin Git.
How do I fix CVE-2021-29468?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-29468 being exploited?
There is no known exploitation of CVE-2021-29468 in the wild and no public exploit code.
Sources
Also known as GHSA-rmp3-wq55-f557, OESA-2021-1210.