Arbitrary File Overwrite in GitPython via Diffable.diff Method

Executive Summary

GitPython versions before 3.1.54 have an arbitrary file overwrite vulnerability in the Diffable.diff method. The method fails to validate git options passed through kwargs, allowing attackers to supply the --output argument to write patch content to attacker-chosen file paths at process privilege level.

Useful 0 Not Useful 0

Detection Guidance

Check GitPython version with pip show gitpython. If version is less than 3.1.54, the system is vulnerable. Search for suspicious git diff commands using process monitoring tools like ps, top, or auditd for commands containing --output or output= arguments.

Useful 0 Not Useful 0

Impact Analysis

Attackers can overwrite critical system files like ~/.ssh/authorized_keys or configuration files, leading to full file corruption or compromise at the process privilege level. No user interaction is required for exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GitPython to version 3.1.54 or later immediately. Review and audit any scripts or applications using GitPython for unsafe argument passing. Implement input validation for all git command arguments in your code.

Useful 0 Not Useful 0