-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability in Git LFS (GHSA-6pvw-g552-53c5) allows for arbitrary file writes through crafted symbolic or hard links during git lfs checkout or git lfs pull operations. The root cause is multifaceted and has been addressed across three key commits.
Improper Link Following: The function lfs.GitFilter.SmudgeToFile, responsible for writing file content, originally used os.Create. This function follows symbolic links by default. An attacker could replace a file tracked by LFS with a symbolic link pointing to an arbitrary location on the filesystem, causing Git LFS to write content to that location. The fix replaces os.Create with os.Remove followed by os.OpenFile with the O_EXCL flag, which ensures a new file is created and does not follow existing symlinks, also mitigating a potential TOCTOU race condition.
Path Traversal via Symlinks in Directories: The commands.singleCheckout.Run function, which is central to both checkout and pull, did not validate that each component of the file's path was a directory. An attacker could replace a directory in the path with a symbolic link to another location. The fix introduces a DirWalker utility that uses os.Lstat (which does not follow symlinks) to verify each path component, preventing this traversal.
Bare Repository Execution: The checkout and pull commands could be run in a bare repository (a repository without a working directory). This led to incorrect path resolution, treating repository-relative paths as absolute filesystem paths, potentially leading to writes outside the repository. The commands.checkoutCommand and commands.singleCheckout.Run functions were patched to detect when they are run in a bare repository and prevent the file write operations from proceeding.
The identified vulnerable functions are the key locations where these flaws existed. During exploitation, these functions would be present in the runtime profile as they are directly involved in the vulnerable file I/O operations.
lfs.GitFilter.SmudgeToFilelfs/gitfilter_smudge.go
commands.singleCheckout.Runcommands/pull.go
commands.checkoutCommandcommands/command_checkout.go
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/git-lfs/git-lfs | go | >= 0.5.2, <= 3.7.0 | 3.7.1 |
Ongoing coverage of React2Shell