CVE-2015-8968

High

Published: 03/11/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2015-8968 vulnerability in git-fastclone before version 1.0.1 allows arbitrary shell command execution from .gitmodules. An attacker can instruct a user to run a recursive clone from a repository they control, enabling the execution of malicious code.

Risk Assessment

The organization may be exposed to unauthorized command execution, potentially leading to system and data compromise. The attack can be conducted on both local and remote repositories.

Recommendation

It is recommended to update git-fastclone to version 1.0.1 or later and to avoid cloning repositories from untrusted sources. Additionally, implementing protections against MITM attacks is advisable.

Other vulnerabilities in git-fastclone

CVE-2015-8969Critical
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to 'cd ' and 'git clone ' commands.

Original NVD description (English source)

git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.