Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-27955

CVE-2020-27955:
Git LFS can execute a Git binary from the current directory

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-27955
GHSA ID
GHSA-4g4p-42wc-9f3m
EPSS Score
0.99698%
CWE
CWE-427
Published
2/11/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/git-lfs/git-lfsgo< 2.12.12.12.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how Git LFS executes Git commands via subprocess.ExecCommand. The function calls exec.Command(name, arg...) where 'name' is 'git' without a path. On Windows, this triggers the OS to search the current directory first for executables (CWE-427). The provided code example and advisory explicitly show this pattern, making this function the root cause. No other functions are mentioned in the context as contributing to this specific vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t On Win*ows, i* *it L*S op*r*t*s on * m*li*ious r*pository wit* * `*it.**t` or `*it.*x*` *il* in t** *urr*nt *ir**tory, t**t pro*r*m woul* ** *x**ut**, p*rmittin* t** *tt**k*r to *x**ut* *r*itr*ry *o**. T*is *o*s not *****t Unix syst*ms.

Reasoning

T** vuln*r**ility st*ms *rom *ow *it L*S *x**ut*s *it *omm*n*s vi* su*pro**ss.*x***omm*n*. T** *un*tion **lls *x**.*omm*n*(n*m*, *r*...) w**r* 'n*m*' is '*it' wit*out * p*t*. On Win*ows, t*is tri***rs t** OS to s**r** t** *urr*nt *ir**tory *irst *or