CVE-2024-32002

🗓️ 14 May 2024 18:40:46Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 704 Views🌐 WEB

Git prior to 2.45.1 allows writing files into `.git/` director

Reporter	Title	Published	Views	Family All 288
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	30 Jul 202414:58	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	1 Jun 202420:19	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	6 Mar 202509:40	–	githubexploit
GithubExploit	Exploit for CVE-2025-2783	26 May 202512:51	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	27 Sep 202403:10	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	18 May 202402:42	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	17 May 202419:35	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	22 May 202411:32	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	18 May 202411:23	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Git	27 Jul 202423:44	–	githubexploit

NVD

Vulners

Vulnrichment

Node

git gitRange<2.39.4

git gitRange2.40.0–2.40.2

git gitRange2.42.0–2.42.2

git gitRange2.43.0–2.43.4

git gitMatch2.41.0

git gitMatch2.44.0

git gitMatch2.45.0

[
  {
    "vendor": "git",
    "product": "git",
    "versions": [
      {
        "version": "= 2.45.0",
        "status": "affected"
      },
      {
        "version": "= 2.44.0",
        "status": "affected"
      },
      {
        "version": ">= 2.43.0, < 2.43.4",
        "status": "affected"
      },
      {
        "version": ">= 2.42.0, < 2.42.2",
        "status": "affected"
      },
      {
        "version": "= 2.41.0",
        "status": "affected"
      },
      {
        "version": ">= 2.40.0, < 2.40.2",
        "status": "affected"
      },
      {
        "version": "< 2.39.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv
github	www.github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d
lists	www.lists.debian.org/debian-lts-announce/2024/06/msg00018.html
openwall	www.openwall.com/lists/oss-security/2024/05/14/2
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/
git-scm	www.git-scm.com/docs/git-config
git-scm	www.git-scm.com/docs/git-clone
lists	www.lists.debian.org/debian-lts-announce/2024/09/msg00009.html

Parameter	Position	Path	Description	CWE
A/modules/x	path	[email protected]:amalmurali47/git_rce.git	CVE-2024-32002 PoC: RCE via crafted submodule path during recursive clone	CWE-22, CWE-434, CWE-59
A/modules/x	path	https://github.com/JakobTheDev/cve-2024-32002-submodule-rce.git	PoC exploiting CVE-2024-32002 via submodule path injection	CWE-22, CWE-434, CWE-59
Submodule/notexists	path	https://github.com/JakobTheDev/cve-2024-32002-poc-aw.git	AW PoC demonstrating arbitrary write into .git via crafted submodule path	CWE-22, CWE-434, CWE-59
Submodule/x	path	https://github.com/EQSTSeminar/git_rce.git	PoC demonstrating RCE via git submodules and symlink handling during clone	CWE-22, CWE-434, CWE-59
hook path	path	https://github.com/EQSTSeminar/git_rce.git	PoC demonstrating RCE via git submodules and symlink handling during clone	CWE-22, CWE-434, CWE-59
post-checkout	path	[email protected]:bfengj/CVE-2024-32002-Exploit.git	Exploit repo demonstrating RCE via malicious git hooks executed during clone	CWE-22, CWE-434, CWE-59
hook	path	[email protected]:bfengj/CVE-2024-32002-Exploit.git	Exploit repo demonstrating RCE via malicious git hooks executed during clone	CWE-22, CWE-434, CWE-59

17 Jun 2026 07:29Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19

EPSS0.29234

SSVC

git submodule exploit patched symbolic link cloning