CVE-2023-23946: Git Path Traversal Vulnerability

CVE-2023-23946 Overview

CVE-2023-23946 is a path traversal vulnerability in Git, the widely-used distributed revision control system. This vulnerability allows an attacker to craft malicious input that, when processed by the git apply command, can overwrite files outside the intended working tree. The vulnerability exploits improper path validation when applying patches, potentially enabling arbitrary file writes with the privileges of the user executing the command.

Critical Impact

Attackers can craft malicious patches to overwrite arbitrary files outside the Git working directory, potentially leading to code execution, configuration tampering, or system compromise when users apply untrusted patches.

Affected Products

• Git versions prior to 2.39.2
• Git versions prior to 2.38.4, 2.37.6, 2.36.5, 2.35.7
• Git versions prior to 2.34.7, 2.33.7, 2.32.6, 2.31.7, 2.30.8

Discovery Timeline

• 2023-02-14 - CVE-2023-23946 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-23946

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in Git's patch application mechanism. The git apply command is designed to apply patches to files within a Git repository's working tree. However, prior to the patched versions, insufficient validation of symbolic links within crafted patches allowed attackers to escape the working tree boundary.

The attack leverages a two-stage approach: first, a malicious patch creates a symbolic link pointing to a directory outside the working tree, then a subsequent patch operation writes files through this symbolic link. This effectively bypasses the intended path containment, allowing file writes to arbitrary locations accessible by the user running git apply.

The vulnerability is particularly concerning in automated CI/CD pipelines, code review systems, and any workflow where patches from untrusted sources are automatically applied. Since the attack requires only network-level access to deliver a crafted patch file, it represents a significant risk for development environments.

Root Cause

The root cause is improper input validation in Git's patch application logic. Specifically, Git failed to adequately verify that files created or modified by a patch operation would remain within the working tree after symbolic link resolution. The patch validation did not account for the scenario where a symbolic link created by the patch itself could redirect subsequent file operations outside the repository boundaries.

Attack Vector

The attack requires an attacker to craft a malicious patch file that:

1. Creates a symbolic link within the working tree pointing to a target directory outside the repository
2. Includes subsequent hunks that write files through the newly created symbolic link

When a user applies this patch using git apply, the files are written to the attacker-controlled location. This can be exploited to overwrite critical configuration files, inject malicious code into trusted locations, or modify system binaries if the user has sufficient privileges.

+Git v2.30.8 Release Notes
+=========================
+
+This release addresses the security issues CVE-2023-22490 and
+CVE-2023-23946.
+
+
+Fixes since v2.30.7
+-------------------
+
+ * CVE-2023-22490:
+
+   Using a specially-crafted repository, Git can be tricked into using
+   its local clone optimization even when using a non-local transport.
+   Though Git will abort local clones whose source $GIT_DIR/objects
+   directory contains symbolic links (c.f., CVE-2022-39253), the objects
+   directory itself may still be a symbolic link.
+
+   These two may be combined to include arbitrary files based on known
+   paths on the victim's filesystem within the malicious repository's
+   working copy, allowing for data exfiltration in a similar manner as
+   CVE-2022-39253.
+
+ * CVE-2023-23946:
+
+   By feeding a crafted input to "git apply", a path outside the
+   working tree can be overwritten as the user who is running "git
+   apply".
+
+ * A mismatched type in `attr.c::read_attr_from_index()` which could

Source: GitHub Commit

Detection Methods for CVE-2023-23946

Indicators of Compromise

• Unexpected symbolic links created within Git repositories pointing to directories outside the working tree
• Unusual file modifications in system directories or configuration files following git apply operations
• Patch files containing symbolic link creation followed by file writes to paths through that symlink
• Audit logs showing git apply commands processing patches from untrusted or external sources

Detection Strategies

• Monitor git apply command executions, especially those processing patches from external sources or email attachments
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Review Git hooks and automation scripts for unsanitized patch application workflows
• Scan incoming patch files for suspicious patterns including symbolic link creation followed by path traversal sequences

Monitoring Recommendations

• Enable audit logging for Git operations in CI/CD environments and development workstations
• Configure SentinelOne to monitor for suspicious file system operations originating from Git processes
• Implement alerting for git apply operations that result in file writes outside repository directories
• Establish baseline behavior for Git operations to detect anomalous patch application patterns

How to Mitigate CVE-2023-23946

Immediate Actions Required

• Upgrade Git to version 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, or 2.30.8 depending on your release branch
• Audit all systems for Git installations and prioritize patching development servers and CI/CD infrastructure
• Review recent patch application history to identify any potentially malicious patches that may have been applied
• Restrict git apply usage to trusted patch sources until patching is complete

Patch Information

Security fixes have been released across multiple Git version branches. The patch addresses the symbolic link handling in git apply to prevent path traversal outside the working tree. The fix is available in the following versions: v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. For implementation details, see the GitHub Security Advisory and the commit fix.

Workarounds

• Use git apply --stat to inspect patches before applying to identify suspicious symbolic link creation
• Avoid applying patches that create symbolic links followed by file writes beyond those links
• Implement pre-apply patch validation in automated workflows to reject patches with symbolic link patterns
• Run git apply operations in sandboxed or containerized environments with restricted file system access

# Inspect a patch before applying to check for symbolic links
git apply --stat suspicious.patch

# Check patch for symbolic link mode (120000)
grep -E "^new file mode 120000" suspicious.patch

# Apply with verbose output to monitor operations
git apply --verbose --check patch.diff