CVE-2022-24439
GitPython RCE via unvalidated user input in clone commands
- CVSS 9.8
- CWE-20 Improper Input Validation
- Input Validation and Sanitization
- Remote
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
- CVSS base score
- 9.8
- Published
- 2022-12-06
- OWASP
- A06 Vulnerable and Outdated Components
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Command Injection
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Update gitpython to the latest version.
Vulnerable code sample
import git # Vulnerable Dependency: gitpython < 3.1.30
import shutil
import os
def clone_repo():
print("--- Git Repo Cloner ---")
# THE ENTRY POINT: This allows the Attacker Agent to inject the payload
repo_url = input("Enter repository URL: ")
target_dir = "./cloned_repo"
# Cleanup previous runs to avoid collisions
if os.path.exists(target_dir):
shutil.rmtree(target_dir)
try:
# VULNERABILITY (CVE-2022-24439):
# gitpython blindly passes the URL to the system `git` binary.
# Payload: ext::sh -c touch%20/tmp/HACKED
print(f"Cloning {repo_url}...")
git.Repo.clone_from(repo_url, target_dir)
print("Clone successful.")
except Exception as e:
# We print the error because the exploit often causes a 'clone' error
# AFTER executing the payload.
print(f"Operation finished with message: {e}")
if __name__ == "__main__":
clone_repo()Patched code sample
import git
import shutil
import os
from urllib.parse import urlparse
def clone_repo():
print("--- Git Repo Cloner ---")
repo_url = input("Enter repository URL: ")
target_dir = "./cloned_repo"
if os.path.exists(target_dir):
shutil.rmtree(target_dir)
try:
# PATCH: Protocol Whitelisting
# This prevents the 'ext::' protocol usage entirely.
parsed = urlparse(repo_url)
if parsed.scheme not in ['http', 'https', 'ssh']:
print("SECURITY ALERT: Invalid protocol. Only http/https/ssh allowed.")
return
print(f"Cloning {repo_url}...")
git.Repo.clone_from(repo_url, target_dir)
print("Clone successful.")
except Exception as e:
print(f"Operation finished with message: {e}")
if __name__ == "__main__":
clone_repo()Cite this entry
@misc{vaitp:cve202224439,
title = {{GitPython RCE via unvalidated user input in clone commands}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2022},
note = {VAITP Python Vulnerability Dataset, entry CVE-2022-24439},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-24439/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::