Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork937
Untrusted search path on Windows systems leading to arbitrary code execution
Description
Summary
When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment (see big warning inhttps://docs.python.org/3/library/subprocess.html#popen-constructor). GitPython defaults to use thegit command, if a user runs GitPython from a repo has agit.exe orgit executable, that program will be run instead of the one in the user'sPATH.
Details
This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo.
The execution of thegit command happens in
Line 277 in1c8310d
| git_exec_name="git"# default that should work on linux and windows |
Lines 983 to 996 in1c8310d
| proc=Popen( | |
| command, | |
| env=env, | |
| cwd=cwd, | |
| bufsize=-1, | |
| stdin=istreamorDEVNULL, | |
| stderr=PIPE, | |
| stdout=stdout_sink, | |
| shell=shellisnotNoneandshellorself.USE_SHELL, | |
| close_fds=is_posix,# unsupported on windows | |
| universal_newlines=universal_newlines, | |
| creationflags=PROC_CREATIONFLAGS, | |
| **subprocess_kwargs, | |
| ) |
And there are other commands executed that should probably be aware of this problem.
PoC
On a Windows system, create agit.exe orgit executable in any directory, and import or run GitPython from that directory
python -c "import git"The git executable from the current directory will be run.
Impact
An attacker can trick a user to download a repository with a maliciousgit executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands.
Possible solutions
- Default to an absolute path for the git program on Windows, like
C:\\Program Files\\Git\\cmd\\git.EXE(default git path installation). - Require users to set the
GIT_PYTHON_GIT_EXECUTABLEenvironment variable on Windows systems. - Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the
GIT_PYTHON_GIT_EXECUTABLEenv var to an absolute path. - Resolve the executable manually by only looking into the
PATHenvironment variable (suggested by@Byron)
Note
This vulnerability was reported via email, and it was decided to publish it here and make it public, so the community is aware of it, and a fix can be provided.