💥 CVE-2024-32002 – Git Submodule Path Injection PoC

Motivation

While solving the Compiled machine on the Hack The Box platform, I came across a curious behavior involving Git and submodules. Upon investigating further, I found this excellent post by researcher Amal Murali, which details a path injection technique via .gitmodules. From there, I decided to study CVE-2024-32002 and create a practical PoC demonstrating the real impact of the vulnerability.

🧠 Vulnerability Overview

CVE-2024-32002 exploits a critical flaw in Git related to submodule path resolution. Git allows repositories to include submodules defined in the .gitmodules file, specifying both a path and a URL. The vulnerability arises when the path is manipulated to point inside the .git directory, which stores metadata and internal configurations of the repository.

By combining:

• Manipulation of .gitmodules to set the path to A/modules/x
• Creation of a symlink a → .git

…Git is tricked into resolving A/modules/x as .git/modules/x, i.e., inside the internal .git directory. This allows an attacker to inject arbitrary files such as malicious hooks, which can be executed during legitimate operations like checkout, merge, or clone.

This vulnerability represents a remote code execution vector, especially dangerous in CI/CD environments, automation, or shared repositories.

⚙️ What the setup.sh script demonstrates

This script automates the creation of a vulnerable environment and reproduces the impact of the flaw:

1. Creates a malicious submodule (hook-repo) containing a post-checkout hook that writes to /tmp/teste.txt
2. Initializes the main repository (main-repo) and adds the submodule
3. Modifies the .gitmodules file to redirect the submodule path to A/modules/x
4. Creates a symlink a → .git, causing A/modules/x to be resolved as .git/modules/x
5. Injects the malicious .gitmodules into the index using git update-index --index-info
6. Performs a legitimate commit to simulate normal activity
7. Clones the repository (cloned-repo) with , initializing the submodule

If successful, the hook executes and creates the file /tmp/teste.txt with the content:

joao was here

🐳 Docker Environment

This repository includes a Dockerfile that:

1. **Installs Git 2.45.0 (vulnerable version)
2. **Creates a normal user (joao)
3. **Copies the PoC files
4. **Automatically runs setup.sh

🔧 How to reproduce

docker build -t git-cve-poc .
docker run --rm -it git-cve-poc

🔐 Impact and Mitigation

This vulnerability affects Git versions prior to 2.45.1. The flaw was fixed with stricter validations in submodule path resolution. Repositories that use submodules should be audited, and automated environments should be updated immediately.

⚠️ Legal Disclaimer

This project is for educational and research purposes only. Do not use in production environments. The goal is to demonstrate the technical impact of the vulnerability and promote good security practices.