Executive brief
GitPython is a widely-used library that applications use to interact with Git repositories. On Windows, GitPython can be tricked into running malicious executables (git.exe or bash.exe) from an untrusted repository if shell execution is enabled or if git hooks are present. An attacker controlling a repository branch or fork could achieve arbitrary code execution on systems using affected versions.
Technical details
This is an incomplete fix for CVE-2023-40590 affecting path search on Windows. The vulnerability exists in two scenarios: (1) when GitPython uses a shell to execute git commands with shell=True or Git.USE_SHELL=True, the Windows cmd.exe shell performs path lookup and can find malicious git.exe in the current directory or repository root, and (2) when running git hooks, GitPython uses bash.exe without safeguards to prevent loading a malicious bash.exe from the current directory. Attack vectors require user interaction (cloning/checking out an untrusted repository or reviewing a malicious branch) and are limited to Windows systems. An attacker can achieve arbitrary code execution with the privileges of the process running GitPython. The fix was released in GitPython 3.1.41 by properly setting the NoDefaultCurrentDirectoryInExePath environment variable in subprocess calls.
Affected products
- GitPython GitPython <= 3.1.40
Timeline
- 2024-01-10: disclosed
- 2024-01-10: patched: Fixed in version 3.1.41