CVE-2024-32002 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
Attackers can achieve remote code execution by crafting malicious Git repositories with submodules on case-insensitive filesystems supporting symlinks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32002?
CVE-2024-32002 is a critical code injection vulnerability in git, published on 14 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.
Which versions are affected by CVE-2024-32002?
1 open source package ship an affected version, including git. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
git Bitnami | All versions | 2.39.4, 2.40.2, 2.41.1, 2.42.2, 2.43.4, 2.44.1, 2.45.1 |
Products include Git Git.
How do I fix CVE-2024-32002?
Upgrade git to a fixed version for your release line: 2.39.4, 2.40.2, 2.41.1 or 2.42.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-32002 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32002 exists.
Public exploit code: 64 proofs of concept on GitHub.
Other vulnerabilities in git
Sources
Also known as ALPINE-CVE-2024-32002, AZL-42040, AZL-43038, BELL-CVE-2024-32002, BIT-git-2024-32002, CLEANSTART-2026-EJ88991 and 7 more.