CVE-2020-5260: Git Credential Disclosure Vulnerability

CVE-2020-5260 Overview

CVE-2020-5260 is a credential theft vulnerability in Git that allows attackers to trick Git into sending private credentials to attacker-controlled hosts. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs containing an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter.

Critical Impact

Attackers can steal stored credentials for any host by crafting malicious URLs, enabling credential theft across development environments and automated build systems.

Affected Products

• Git (versions prior to 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1)
• Canonical Ubuntu Linux (16.04 LTS, 18.04 LTS, 19.10)
• Debian Linux (8.0, 9.0, 10.0)
• Fedora (30, 31, 32)
• openSUSE Leap (15.1)

Discovery Timeline

• April 14, 2020 - CVE-2020-5260 published to NVD
• April 14, 2020 - Git project releases security patches for multiple version branches
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-5260

Vulnerability Analysis

This vulnerability exploits a fundamental weakness in how Git parses and processes URLs before communicating with credential helper programs. When Git encounters a URL requiring authentication, it extracts components (protocol, host, path, username) and sends them to the credential helper via a line-based protocol. The protocol uses newline characters as delimiters between key-value pairs. By embedding URL-encoded newline characters (%0a) within the URL, an attacker can inject arbitrary key-value pairs into this protocol stream.

The attack is particularly dangerous because there are no restrictions on the relationship between the spoofed host and the actual target. An attacker can craft a URL that presents stored credentials for any host (including internal repositories, CI/CD systems, or private services) to a malicious host of their choosing. The credential helper, trusting the injected host= directive, retrieves and returns credentials for the victim host.

Root Cause

The root cause is improper input validation (CWE-20) combined with insufficiently protected credentials (CWE-522). The Git URL parser failed to reject or sanitize newline characters within URL components before passing them to the credential helper protocol. Since the credential helper protocol is newline-delimited, embedded newlines could inject additional protocol commands, effectively bypassing the intended authentication flow and causing credential misdirection.

Attack Vector

The vulnerability can be triggered by feeding a malicious URL to git clone, though the suspicious-looking URLs make direct social engineering difficult. The more likely attack vectors include:

• Git submodules: A malicious repository could include submodules with crafted URLs that silently exploit the vulnerability when users clone the parent repository
• Package systems: Build systems and package managers that automatically fetch Git repositories could process malicious URLs from dependency specifications
• CI/CD pipelines: Automated systems that clone repositories based on user-provided input without URL validation

The attack requires no authentication and can be executed remotely over the network without user interaction in automated scenarios.

// Security patch from credential.c - Source: https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b
 {
 	if (!value)
 		return;
+	if (strchr(value, '\n'))
+		die("credential value for %s contains newline", key);
 	fprintf(fp, "%s=%s\n", key, value);
 }

Source: Git Commit 9a6bbee

The patch adds explicit validation to reject any credential values containing newline characters, preventing protocol injection attacks.

Detection Methods for CVE-2020-5260

Indicators of Compromise

• Unexpected network connections to unknown hosts during Git operations
• Git credential helper logs showing unusual host values or protocol sequences
• Repository configurations (.gitmodules, .gitconfig) containing URLs with %0a or %0d encoded characters
• Audit logs showing credential requests for hosts not matching the repository being cloned

Detection Strategies

• Monitor Git operations for URLs containing URL-encoded newline characters (%0a, %0d, %0D, %0A)
• Implement network monitoring to detect credential submissions to unexpected destinations
• Scan Git repositories for malicious submodule URLs before cloning
• Review CI/CD pipeline logs for suspicious Git clone operations or unusual repository URLs

Monitoring Recommendations

• Enable verbose logging for Git credential helper operations to detect anomalies
• Implement network segmentation and egress filtering to limit credential exposure
• Deploy repository scanning tools to identify malicious .gitmodules files before developers clone them
• Use SentinelOne's Singularity platform to monitor for suspicious process behavior during Git operations

How to Mitigate CVE-2020-5260

Immediate Actions Required

• Update Git to a patched version immediately: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, or 2.26.1
• Audit existing repositories for malicious submodule URLs containing encoded newlines
• Review and rotate any credentials that may have been exposed through automated Git operations
• Disable automatic submodule cloning in CI/CD pipelines until systems are patched

Patch Information

The vulnerability was patched in versions released on April 14, 2020, going back to v2.17.x. The critical fix is contained in commit 9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b. For organizations needing to backport the fix to older versions, applying this single commit is sufficient to protect clients against the vulnerability. The full releases include additional checks for git fsck but the core protection is in this commit.

Additional vendor patches are available:

• GitHub Security Advisory GHSA-qm7j-c969-7j4q
• Ubuntu Security Notice USN-4329-1
• Debian Security Advisory DSA-4657
• Gentoo GLSA 202004-13

Workarounds

• Disable Git credential helpers temporarily by setting git config --global credential.helper ""
• Manually verify all repository URLs and submodule URLs before cloning untrusted repositories
• Use SSH-based authentication instead of HTTP/HTTPS with stored credentials where possible
• Implement URL allowlisting in CI/CD systems to prevent cloning from untrusted sources

# Configuration example - Disable credential helper temporarily
git config --global credential.helper ""

# Verify no malicious URLs in submodules before cloning
git config --get-regexp 'submodule\..*\.url' | grep -E '%0[aAdD]'

# Use SSH instead of HTTPS to avoid credential helper exposure
git config --global url."git@github.com:".insteadOf "https://github.com/"