Impact

This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder C:\.git, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory.

Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash with the current working directory outside of a trusted Git repository.

Patches

The problem has been addressed in v2.35.2.vfs.0.0.

Workarounds

Create the folder .git on all drives where Git commands are run, and remove read/write access from those folders:

mkdir \.git
icacls \.git /inheritance:r

Alternatively, define or extend GIT_CEILING_DIRECTORIES to cover the parent directory of the user profile, e.g. C:\Users if the user profile is located in C:\Users\my-user-name.

References

• GIT_CEILING_DIRECTORIES
• Git for Windows' CVE-2022-24765, which is less impacted because it lacks support for the pre-command/post-command hooks.

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Microsoft fork of Git
• For sensitive questions or responsible disclosures, email the Git Security mailing list