CVE-2025-48384

Overview of CVE-2025-48384

CVE-2025-48384 is a critical vulnerability in Git, the widely used distributed version control system. It involves improper handling of carriage return (CR) characters in configuration values, which can lead to path traversal issues during submodule checkouts. This flaw allows for potential arbitrary code execution under specific conditions. The vulnerability was publicly disclosed on July 8, 2025, and last modified on August 26, 2025. It has been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on August 25, 2025, indicating active exploitation in the wild, with a remediation due date of September 15, 2025.

Vulnerability Description

The issue stems from how Git processes configuration values:

• When reading a config value, Git strips any trailing carriage return and line feed (CRLF) characters.
• However, when writing a config entry, values containing a trailing CR are not properly quoted, causing the CR to be lost during subsequent reads.

This discrepancy can cause a submodule to be checked out to an incorrect location if its path includes a trailing CR. If an attacker sets up a symlink that points this altered path to the submodule's hooks directory—and the submodule contains an executable post-checkout hook—the hook script could be executed unintentionally after checkout, resulting in arbitrary code execution.

Technical Details

The vulnerability exploits an interpretation conflict in Git's config parsing:

• Config Handling Mismatch: Trailing CRs are stripped on read but not preserved on write without quoting.
• Submodule Checkout Path Alteration: A submodule path like "submodule/path" might be interpreted as "submodule/path" after the CR is lost.
• Symlink Exploitation: An attacker could create a symlink from the altered path to the hooks directory (e.g., .git/hooks/post-checkout), allowing execution of malicious hooks during operations like git submodule update or git clone --recurse-submodules.

This is classified under:

• CWE-436: Interpretation Conflict (mismatch in how data is processed).
• CWE-59: Improper Link Resolution Before File Access ('Link Following'), due to symlink abuse.

The attack vector is network-based (AV:N), with high complexity (AC:H), low privileges required (PR:L), required user interaction (UI:R), and a changed scope (S:C), impacting confidentiality, integrity, and availability highly (C:H/I:H/A:H).

Affected Versions

The vulnerability affects Git versions prior to the following patched releases:

• All versions before v2.43.7
• v2.44.0 to v2.44.3
• v2.45.0 to v2.45.3
• v2.46.0 to v2.46.3
• v2.47.0 to v2.47.2
• v2.48.0 to v2.48.1
• v2.49.0
• v2.50.0

It impacts Git on various platforms, including Linux, macOS, and Windows, but is particularly relevant in developer environments, CI/CD pipelines (e.g., GitHub Actions, GitLab CI), and anywhere Git submodules are cloned from untrusted repositories.

Impact and Exploitation Scenarios

• Impact: High risk of remote code execution (RCE), data exfiltration, or system compromise. In developer workflows, this could lead to supply chain attacks if malicious repositories are cloned.
• Exploitation Requirements:
  • A specially crafted submodule path with a trailing CR.
  • A symlink redirecting to the hooks directory.
  • An executable hook (e.g., post-checkout) in the submodule.
  • User interaction, such as cloning a repository with --recurse-submodules.
• Real-World Exploitation: As it's in CISA's KEV catalog, federal agencies and critical infrastructure must remediate by September 15, 2025. It's likely being exploited in targeted attacks against developers or open-source projects. No public proof-of-concept (PoC) is mentioned in the advisory, but the high complexity suggests it requires specific setup.

CVSS details are not fully scored in NVD yet (CVSS 4.0 pending), but based on CVSS 3.1 metrics from the advisory, it aligns with a critical severity (estimated CVSS 8.8, as previously noted in broader CVE lists).

Mitigation and Recommendations

• Fixed Versions: Update Git to one of the following or later:
  • v2.43.7
  • v2.44.4
  • v2.45.4
  • v2.46.4
  • v2.47.3
  • v2.48.2
  • v2.49.1
  • v2.50.1
• Workarounds:
  • Avoid cloning submodules recursively (--recurse-submodules) from untrusted repositories.
  • Disable or restrict symlink usage in Git configurations if possible.
  • Use Git in environments with restricted permissions (e.g., containerized setups).
• Additional Advice: For organizations under CISA directives, apply patches per vendor instructions or discontinue use if unpatchable. Regularly scan repositories for suspicious submodules and monitor for unexpected hook executions.

Credits and References

• Credits: The advisory credits ttaylorr for reporting and publishing details.
• Key References:
  • NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-48384
  • GitHub Advisory: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9
  • CISA KEV Catalog: (Integrated into NVD details)

This vulnerability highlights the importance of secure handling in version control systems, especially with submodules. If you're using Git in a production or development environment, prioritize updating immediately, given the active exploitation status.

Quick PoC

• Prereqs: Docker installed; this repo cloned locally. No network needed during PoC.
• Vulnerable Git: Uses Git 2.40.4 (verified path-confusion behavior).
• Submodule URL: .gitmodules points to https://github.com/s41r4j/CVE-2025-48384-submodule.git, but the PoC rewrites it to a local copy for offline testing.

Run:

bash scripts/poc.sh

What it does:

• Builds a container image with Git 2.40.4.
• Creates a flag at $HOME/flag.txt inside the container.
• Copies malicious-submodule-repo/ to /tmp in the container.
• Clones this repo recursively with a URL rewrite to that local submodule copy.
• Forces checkout to trigger the post-checkout hook if the path-confusion succeeds.
• Prints /tmp/flag.txt created by the hook.

Notes:

• The malicious submodule path is a literal sub^M (CR) stored as a gitlink; the sanitized path sub resolves via a symlink to .git/hooks, so the submodule’s tracked post-checkout lands as an actual hook and runs.
• To retarget the gitlink to your remote submodule’s latest commit after you push it to GitHub, run: bash scripts/update-gitlink.sh.