Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| GitPython | pip | <= 3.1.58 | 3.1.59 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the unsafe_git_clone_options denylist in git/repo/base.py was missing the "--separate-git-dir" option. This allowed an attacker to pass this option through the public Repo.clone_from() and Repo.clone() methods. These methods call the internal Repo._clone() method, which is responsible for executing the git clone command. The _clone method checks the options against the incomplete denylist, and thus fails to block the malicious option. This allows an attacker to create a git repository directory at an arbitrary location on the filesystem, leading to a path traversal vulnerability (CWE-22). The fix involves adding the missing option to the denylist, which is then correctly enforced by Repo._clone(). The analysis of the patch also revealed that Submodule._clone_repo was an internal caller of the vulnerable clone functionality and was updated to handle the new security constraints.
Repo._clonegit/repo/base.py
Repo.clone_fromgit/repo/base.py
Repo.clonegit/repo/base.py
Submodule._clone_repogit/objects/submodule/base.py