^{CVE-2021-21300:}Git vulnerability allows remote code execution during clone operations when symbolic links and clean/smudge filters are used on case-insensitive file systems.

Overview

This vulnerability (CVE-2021-21300) is classified as CWE-59, which relates to link following (symlink) vulnerabilities. The issue occurs during the clone operation when Git processes repositories containing both symbolic links and files that use clean/smudge filters such as Git LFS. On case-insensitive file systems (like those used by default on Windows and macOS), this combination can lead to arbitrary code execution as a specially crafted repository can cause scripts to be executed during the checkout process. The attack vector requires that clean/smudge filters are configured, which is the default setup for Git for Windows with Git LFS. This represents a significant security risk for developers who clone repositories from untrusted sources.

Remediation

1. Update Git to one of the following patched versions: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.6.

2. If updating is not immediately possible, implement one of these workarounds:

   • Disable symbolic link support in Git using the command: git config --global core.symlinks false
   • Remove any global clean/smudge filter configurations (such as Git LFS) before cloning repositories
   • Avoid cloning repositories from untrusted sources

3. For Git for Windows users, be especially cautious as Git LFS is configured by default, making the system vulnerable without additional configuration changes.

References

• GitHub Security Advisory: https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm
• Git patch commit: https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592
• OSS Security mailing list discussion: http://www.openwall.com/lists/oss-security/2021/03/09/3
• Git documentation on filters: https://git-scm.com/docs/gitattributes#_filter
• Git documentation on symlinks: https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks
• Exploit details: http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html
• Kernel.org discussion: https://lore.kernel.org/git/xmqqim6019yd.fsf%40gitster.c.googlers.com/
• Apple security update: https://support.apple.com/kb/HT212320
• Debian security update: https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html
• Gentoo security advisory: https://security.gentoo.org/glsa/202104-01