Clone2Leak attacks exploit Git flaws to steal credentials

A set of three distinct but related attacks, dubbed 'Clone2Leak,' can leak credentials by exploiting how Git and its credential helpers handle authentication requests. The attack can compromise passwords and access tokens in GitHub Desktop, Git LFS, GitHub CLI/Codespaces, and the Git Credential Manager. The flaws that make 'Clone2Leak' possible were discovered by Japanese researcher RyotaK of GMO Flatt Security, who reported them responsibly to the affected projects. Security updates addressing all flaws have been made available, and impacted users are urged to ensure they're running a safe release to mitigate the risk of having their secrets leaked. Each of the flaws discovered by RyotaK revolves around improper parsing of authentication requests made to credential helpers, allowing an attacker to trick Git into leaking stored credentials to a malicious server. Credential helpers are tools that store and retrieve authentication credentials for when Git interacts with remote repositories, helping avoid repeatedly entering credentials for every Git operation. Attackers can trick Git into leaking stored credentials when a user clones or interacts with a malicious repository. Here is an overview of the three ways the Clone2Leak attack can manifest by exploiting various flaws: All vulnerabilities mentioned above have now been patched, but users should ensure their tools are updated, audit credential configurations, and be cautious when cloning repositories. The safe versions to ...