Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| GitPython | pip | <= 3.1.58 |
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-9557-234j-7rv9 (a duplicate of GHSA-284h-m62q-gf8w), describes an issue in GitPython where multi-line git-config values are corrupted into live injected directives during write operations. The analysis started by identifying the patched version (>= 3.1.59) and then comparing the commits between the last vulnerable version (3.1.58) and the first patched version (3.1.59). This led to the identification of commit 4b4e47fc1224e23b0c8ee7220a7192818f2e4abb titled 'fix: preserve multiline config values when writing'.
Upon examining the patch for this commit, the core of the fix was found in git/config.py within the write_section method of the GitConfigParser class. The original code improperly handled newlines in configuration values by replacing them with \n\t. This caused Git to misinterpret the value as a new configuration entry. The patch introduces logic to properly escape special characters (newlines, tabs, backspaces, backslashes, and double quotes) and enclose the value in double quotes, ensuring that multi-line values are correctly serialized as a single, quoted string with appropriate backslash escapes (\n, \t, etc.) that Git understands as part of the value, not as new directives. Therefore, the GitConfigParser.write_section function is the direct point of vulnerability where the improper serialization occurred, leading to the argument injection.
