CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests
Attackers with commit access can execute arbitrary code by manipulating environment variables passed to Git subprocesses in Soft Serve.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41956?
CVE-2024-41956 is a high-severity command injection vulnerability in charmbracelet soft-serve, published on 1 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.
Weakness: CWE-78
Which versions are affected by CVE-2024-41956?
3 open source packages ship an affected version, including github.com/charmbracelet/soft-serve.
| Package | Affected | Fixed in |
|---|---|---|
github.com/charmbracelet/soft-serve Go | All versions | 0.7.5 |
github.com/charmbracelet/soft-serve Go | All versions | 0.7.5 |
github.com/charmbracelet/soft-serve Go | All versions | 0.7.5 |
How do I fix CVE-2024-41956?
Upgrade github.com/charmbracelet/soft-serve to 0.7.5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-41956 being exploited?
There is no known exploitation of CVE-2024-41956 in the wild and no public exploit code.
Sources
Also known as GHSA-m445-w3xr-vp2f, GO-2024-3019.