CVE-2024-22190

Incomplete fix for CVE-2023-40590 in GitPython 3.1.41

• CVSS 7.8
• CWE-426 Untrusted Search Path
• Information Leakage
• Remote

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.

CVE

CVE-2024-22190

CWE

CWE-426 Untrusted Search Path

CVSS base score

7.8

Published

2024-01-11

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update GitPython to version 3.1.41 or later

import subprocess
import os

def run_git_command(command, repo_path):
    """Vulnerable function that demonstrates the security issue."""
    os.chdir(repo_path)

    result = subprocess.run(command, shell=True, check=True, capture_output=True)
    return result.stdout

import os
import subprocess
import sys

def run_git_command(command, repo_path):
    """Secure function that fixes the vulnerability."""
    if not os.path.isabs(repo_path) or not os.path.exists(repo_path):
        raise ValueError("Invalid repository path")

    original_dir = os.getcwd()
    os.chdir(repo_path)

    try:
        git_executable = os.path.join(sys.prefix, 'Scripts', 'git.exe')
        result = subprocess.run([git_executable] + command, check=True, capture_output=True)
        return result.stdout
    finally:
        os.chdir(original_dir)

@misc{vaitp:cve202422190,
  title        = {{Incomplete fix for CVE-2023-40590 in GitPython 3.1.41}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-22190},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-22190/}}
}