Git LFS vulnerability allows attackers to compromise targets’ Windows systems (CVE-2020-27955)

guest · Nov 7, 2020

Git LFS vulnerability allows attackers to compromise targets’ Windows systems (CVE-2020-27955)
November 5, 2020
https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/

A critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for versioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker’s malicious repository using a vulnerable Git version control tool, security researcher Dawid Golunski has discovered.

It can be exploited in a variety of popular Git clients in their default configuration – GitHub CLI, GitHub Desktop, SmartGit, SourceTree, GitKraken, Visual Studio Code, etc. – and likely other clients/development IDEs (i.e., those install git with the Git LFS extension by default).
Click to expand...

The vulnerability can be triggered if the victim is tricked into cloning the attacker’s malicious repository using a vulnerable Git version control tool.
Golunski says that CVE-2020-27955 is trivial to exploit, and has released PoC exploit code, as well as video demonstrations of the exploit in action on various Git clients.
Click to expand...

What to do?
The vulnerability affects Git LFS versions 2.12 or earlier on Windows systems (but not on Unix). According to the Git LFS maintainers, there is no workaround for this issue other than avoiding untrusted repositories.

Affected users and product vendors are advised to update to the latest Git LFS version (v2.12.1, released on Wednesday), which plugged the security hole. Git for Windows has also been updated to include this Git LFS version.
Click to expand...

Log in or Sign up

Git LFS vulnerability allows attackers to compromise targets’ Windows systems (CVE-2020-27955)

guest Guest

Log in or Sign up

Git LFS vulnerability allows attackers to compromise targets’ Windows systems (CVE-2020-27955)

guest Guest

Useful Searches