Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from a 'parity gap' in GitPython's configuration parsing logic. While Repo.config_writer() was hardened to disable merge_includes for security reasons, Submodule._config_parser() was not. This oversight meant that when Submodule._config_parser() created a SubmoduleConfigParser instance to read the .gitmodules file (which is attacker-controlled), it inherited the default merge_includes=True from GitConfigParser.__init__.
This allowed an attacker to craft a .gitmodules file with an [include] directive pointing to an arbitrary local file (e.g., /etc/passwd). When a victim's application called Submodule.iter_items() (or similar submodule enumeration), GitConfigParser.read() would attempt to process this include. Since GitConfigParser.read() lacked proper path containment checks, it would open the specified arbitrary file. If this file was not a valid git-config INI format, GitConfigParser._read() would raise a configparser.MissingSectionHeaderError, embedding the first line of the target file's content directly into the exception message. Because Submodule.iter_items() did not catch this specific exception, the sensitive content was leaked to the calling application, enabling local file content disclosure.
Submodule._config_parsergit/objects/submodule/base.py
GitConfigParser.__init__git/config.py
GitConfigParser.readgit/config.py
GitConfigParser._readgit/config.py
Submodule.iter_itemsgit/objects/submodule/base.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| GitPython | pip | <= 3.1.58 | 3.1.59 |