CVE-2025-61659
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-09-29
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| magicmonty | bash-git-prompt | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-377 | Creating and using insecure temporary files can leave application and system data vulnerable to attack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-61659 is a security flaw in the bash-git-prompt project where temporary files are created with predictable names based on the process ID (pid), such as /tmp/git-index-private$$. Because these filenames are guessable, attackers can create symbolic links with those names to trick the script into overwriting arbitrary files via the cp command. This vulnerability arises from insecure temporary file handling and can be mitigated by using secure methods like mktemp to generate unpredictable temporary filenames and directories. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to perform symlink attacks that cause the bash-git-prompt script to overwrite arbitrary files on the system. This could lead to unauthorized modification or corruption of files, potentially compromising system integrity, causing data loss, or enabling further exploitation depending on which files are overwritten. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking for the presence of the predictable temporary files `/tmp/git-index-private$$` and `/tmp/git-index-private*.lock` where `$$` is the bash process ID. Since the process ID is guessable, you can list these files using commands like `ls /tmp/git-index-private*`. Additionally, you can find bash process IDs with `ps` commands (e.g., `ps -ef | grep bash`) and check if corresponding temporary files exist. Monitoring for unexpected symbolic links at these paths can also indicate exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves modifying the bash-git-prompt script to replace the use of predictable pid-based temporary filenames with secure, unpredictable filenames generated by `mktemp`. Specifically, use `mktemp` to create temporary files and directories (e.g., `mktemp -d`) to contain all temporary files including `.lock` files. This prevents attackers from predicting or creating symbolic links to these files, mitigating symlink attacks and arbitrary file overwrites. [1]