module

Git LFS Clone Command Exec

Try Surface Command
Back to search
Disclosed
2021-04-26
Created
2021-08-27

Description

Git clients that support delay-capable clean / smudge
filters and symbolic links on case-insensitive file systems are
vulnerable to remote code execution while cloning a repository.

Usage of clean / smudge filters through Git LFS and a
case-insensitive file system changes the checkout order
of repository files which enables the placement of a Git hook
in the `.git/hooks` directory. By default, this module writes
a `post-checkout` script so that the payload will automatically
be executed upon checkout of the repository.

Authors

Johannes Schindelin
Matheus Tavares
Shelby Pace

Platform

Unix

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/multi/http/git_lfs_clone_command_exec
    msf exploit(git_lfs_clone_command_exec) > show targets
        ...targets...
    msf exploit(git_lfs_clone_command_exec) > set TARGET < target-id >
    msf exploit(git_lfs_clone_command_exec) > show options
        ...show and set options...
    msf exploit(git_lfs_clone_command_exec) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today