GHSA-g4v5-fjv9-mhhc: Gitk allows arbitrary command execution
Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.43.7 - Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.44.4 - Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.45.4 - Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.46.4 - Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.47.3 - Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.48.2 - Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.49.1 - Upgrade
Upgrade
gitkto a version that resolves this vulnerability.Fixed in 2.50
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The user must have cloned an attacker-crafted repository and then be tricked into invoking gitk with a filename that has the required structure. The attack relies on social engineering rather than occurring merely from cloning the repository.
What level of access does successful exploitation provide?
The supplied script runs with the privileges of the user who invokes gitk. An attacker can therefore execute arbitrary scripts, including Bourne shell, Perl, or Python scripts, within that user's permissions.
Which versions contain fixes?
Fixes are available in versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50. The issue affects Gitk starting with 2.41.0.