[CVE-2024-32002] Git Code Version Control Software Remote Code Execution Vulnerability with POC/Exploit

Vulnerability description:

Git is a popular distributed version control system for collaborative software development. It can be installed on computers running Windows, macOS, Linux, and various *BSD distributions.

CVE-2024-32002The vulnerability is a vulnerability in Git that enables RCE git clone during operation.By crafting repositories with submodules in a specific way, an attacker can execute malicious hooks by writing files to the directory .git/ using case-insensitive symbolic link handling on the filesystem.

Web-based software development platforms GitHub and GitLab are both based on Git. the widespread adoption of Git in software development exacerbates the potential impact of this vulnerability.

Affected versions:

The vulnerability only applies to Git versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, configured with symbolic linking support and a case-insensitive operating system.

Vulnerability verification:

https://github.com/amalmurali47/git_rce

Note: This PoC is only available for Windows or Mac systems.

Security Updates:

These vulnerabilities have been patched in Git v2.45.1, v2.44.1, v2.43.4, v2.42.2, v2.41.1, v2.40.2, and v2.39.4.

refer to:

https://amalmurali.me/posts/git-rce/

https://github.com/amalmurali47/git_rce

https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d