CVE-2023-29011 Git for Windows's config file of `connect.exe` is susceptible to malicious placing
An attacker can place a malicious config file in a shared directory to execute code or escalate privileges on multi-user Windows machines running Git.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-29011?
CVE-2023-29011 is a high-severity path traversal vulnerability in git-for-windows git, published on 25 Apr 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SSH servers via proxies when certain ports are blocked for outgoing connections. The location of `connect.exe`'s config file is hard-coded as `/etc/connectrc` which will typically be interpreted as `C:\etc\connectrc`. Since `C:\etc` can be created by any authenticated user, this makes `connect.exe` susceptible to malicious files being placed there by other users on the same multi-user machine. The problem has been patched in Git for Windows v2.40.1. As a workaround, create the folder `etc` on all drives where Git commands are run, and remove read/write access from those folders. Alternatively, watch out for malicious `<drive>:\etc\connectrc` files on multi-user machines.
Weakness: CWE-427
Which versions are affected by CVE-2023-29011?
It affects 1 product.
Products include Git for Windows Project Git for Windows.
How do I fix CVE-2023-29011?
No fix has been published for CVE-2023-29011 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-29011 being exploited?
There is no known exploitation of CVE-2023-29011 in the wild and no public exploit code.
Other vulnerabilities in git-for-windows git
- CVE-2023-23618 gitk can inadvertently call executables in the worktree
- CVE-2022-24767 Other in Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- CVE-2016-9274 Privilege escalation in n/a
- CVE-2023-29012 Git CMD erroneously executes `doskey.exe` in the current directory, if it exists
- CVE-2023-22743 Git for Windows' installer is susceptible to DLL side loading attacks
Sources
Also known as GHSA-g4fv-xjqw-q7jm.