Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-5260— malicious URLs may cause Git to present stored credentials to the wrong server

Quick assessment

Affected
git git
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Git是一套免费、开源的分布式版本控制系统。 Git中存在输入验证错误漏洞。攻击者可借助特制URL利用该漏洞获取私人证书。以下产品及版本受到影响：Git 2.17.3及之前版本、2.18.2及之前版本、2.19.3及之前版本、2.20.2及之前版本、2.21.1及之前版本、2.22.2及之前版本、2.23.1及之前版本、2.24.1及之前版本、2.25.2及之前版本、2.26.0及之前版本。

CVSS 9.3 · Critical EPSS 10.05% · P95
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-5260

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
malicious URLs may cause Git to present stored credentials to the wrong server
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Git 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Git是一套免费、开源的分布式版本控制系统。 Git中存在输入验证错误漏洞。攻击者可借助特制URL利用该漏洞获取私人证书。以下产品及版本受到影响：Git 2.17.3及之前版本、2.18.2及之前版本、2.19.3及之前版本、2.20.2及之前版本、2.21.1及之前版本、2.22.2及之前版本、2.23.1及之前版本、2.24.1及之前版本、2.25.2及之前版本、2.26.0及之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
git git < 2.17.4 -

II. Public POCs for CVE-2020-5260

# POC Description Source Link Shenlong Link
1 A HTTP PoC Endpoint for cve-2020-5260 which can be deployed to Heroku https://github.com/brompwnie/cve-2020-5260 POC Details
2 https://bugs.chromium.org/p/project-zero/issues/detail?id=2021 https://github.com/Asgavar/CVE-2020-5260 POC Details
3 CVE-2020-5260演示记录 https://github.com/sv3nbeast/CVE-2020-5260 POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-5260

请登录查看更多情报信息。

Patches & Fixes for CVE-2020-5260 (1)

Vendor Advisories for CVE-2020-5260 (5)

Exploits & Public PoCs for CVE-2020-5260 (1)

Mailing List Discussions for CVE-2020-5260 (10)

Other References for CVE-2020-5260 (1)

IV. Related Vulnerabilities

Same product: git
Same vendor: git
Same weakness: CWE-20

V. Comments for CVE-2020-5260

No comments yet

Leave a comment