Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis is based on the provided vulnerability description and the details from the duplicate advisory GHSA-3wxw-xv34-2frg, which explicitly states the root cause and the specific commit (3af0c251) that introduced an incomplete fix. The vulnerability exists in the TagReference.create() function. The commit 3af0c251 aimed to block unsafe options by adding Git.check_unsafe_options call. However, the implementation of this check was flawed as it only inspected keyword arguments (kwargs) and not positional arguments (args). The reference parameter in TagReference.create() is a positional argument. Therefore, an attacker could pass --file=<path> as the reference positional argument, bypassing the Git.check_unsafe_options guard and leading to an arbitrary file read. The patch_evidence directly points to the lines in commit 3af0c251 where the flawed check was introduced, confirming that the vulnerability exists in the code after this commit but before the complete fix (version 3.1.59). The function TagReference.create is the entry point for the exploit.
TagReference.creategit/refs/tag.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| GitPython | pip | <= 3.1.58 |