GitPython Submodule Path Traversal Vulnerability

Executive Summary

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check GitPython versions before 3.1.58. Run 'pip show GitPython' or 'gitpython --version' to verify installed versions. Inspect .gitmodules files in repositories for suspicious submodule names containing path traversal sequences like ../../../../.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to escape the intended directory and place repositories in attacker-controlled locations. It can lead to high integrity loss as attackers control destination paths and content, and potential low-medium availability impact due to disk exhaustion. The attack requires only that the victim clones and initializes submodules from a malicious repository.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized filesystem access. Attackers may place malicious repositories outside intended directories, potentially accessing or modifying sensitive data in restricted locations. This violates data integrity and access control requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade GitPython to version 3.1.58 or later. Avoid cloning and initializing submodules from untrusted repositories. Review .gitmodules files for malicious submodule names and remove any suspicious entries.

Useful 0 Not Useful 0