Git: Malicious repositories can execute remote code while cloning

Re:Git: Malicious repositories can execute remote code while... by floatingatoll on Tuesday March 09, 2021 @05:23PM (#26405196)

> if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS)

What is the simple test for whether this is the case or not?

Is this a default-on scenario?

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by matheust on Tuesday March 09, 2021 @09:22PM (#26407032)

> What is the simple test for whether this is the case or not?

As suggested in GitHub's announcement post[1], you can test this with the following:

`git config --show-scope --get-regexp 'filter\..*\.process'` (replace the single quotes by double quotes on Windows Command Prompt)

> Is this a default-on scenario?

On Windows yes, because Git-for-Windows configures Git LFS by default.

[1]: https://github.blog/2021-03-09-git-clone-vulnerability-annou...

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by dragonwriter on Tuesday March 09, 2021 @09:28PM (#26407059)

Doesn't Git-for-Windows default configure symbolic link support off, though? Or does this exploit work even in that case as long as the underlying file system supports symlinks?

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by matheust on Tuesday March 09, 2021 @10:47PM (#26407530)

Git-for-Windows may turn symlink support on by default under some specific circumstances. As the repo's wiki [1] says:

Short version: there is no exact equivalent for POSIX symlinks on Windows, and the closest thing is unavailable for non-admins by default unless Developer Mode is enabled and a relatively recent Windows 10 version is used. Therefore, symlink emulation support is only turned on by default when that scenario is detected.

[1]: https://github.com/git-for-windows/git/wiki/Symbolic-Links

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by goatinaboat on Tuesday March 09, 2021 @05:40PM (#26405415)

Is this a default-on scenario?

No, LFS is something you would have to explicitly enable, however it is pretty common to do so if you want to store binary blobs in Git.

[ Parent | on HN ]

Re:Git: Malicious repositories can execute remote code while... by ExtraE on Tuesday March 09, 2021 @11:29PM (#26407773)

Git for windows has LFS on by default.

[ Parent | on HN ]