#今天又看了啥 #security #git #CVE
Exploiting CVE-2024-32002: RCE via git clone
A vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on case-insensitive filesystems to write files into the .git/ directory, leading to the execution of malicious hooks.
通过以特定的方式使用子模块制作存储库，攻击者可以利用不区分大小写的文件系统上的符号链接处理将文件写入 .git/ 目录，从而导致在 git clone 操作期间恶意钩子执行触发 RCE。
https://amalmurali.me/posts/git-rce/
PoC: https://github.com/amalmurali47/git_rce
Exploiting CVE-2024-32002: RCE via git clone
A vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on case-insensitive filesystems to write files into the .git/ directory, leading to the execution of malicious hooks.
通过以特定的方式使用子模块制作存储库，攻击者可以利用不区分大小写的文件系统上的符号链接处理将文件写入 .git/ 目录，从而导致在 git clone 操作期间恶意钩子执行触发 RCE。
https://amalmurali.me/posts/git-rce/
PoC: https://github.com/amalmurali47/git_rce
amalmurali.me
Exploiting CVE-2024-32002: RCE via git clone
A new RCE in Git caught my attention on a recent security feed, labeled CVE-2024-32002. Given Git’s ubiquity and the widespread use of the clone command, I was instantly intrigued. Could something as routine as cloning a repository really open the door to…
