CVE-2024-50349: Git Information Disclosure Vulnerability

CVE-2024-50349 Overview

CVE-2024-50349 is an improper output encoding vulnerability in Git, the widely-used distributed revision control system. When Git prompts for credentials via a terminal (without using a credential helper), it displays the host name for which authentication is required. However, URL-encoded parts are decoded before display, allowing attackers to inject ANSI escape sequences into crafted URLs. These sequences can manipulate terminal output to deceive users into providing credentials for what appears to be a trusted Git hosting site, when in reality the credentials are being sent to an attacker-controlled server.

Critical Impact

Attackers can craft malicious repository URLs containing ANSI escape sequences that manipulate terminal displays, potentially tricking developers into providing credentials to untrusted sites while believing they are authenticating to legitimate Git hosting services.

Affected Products

• Git versions prior to v2.48.1
• Git versions v2.47.x prior to v2.47.2, v2.46.x prior to v2.46.3, v2.45.x prior to v2.45.3, v2.44.x prior to v2.44.3, v2.43.x prior to v2.43.6, v2.42.x prior to v2.42.4, v2.41.x prior to v2.41.3, and v2.40.x prior to v2.40.4
• Debian Linux 11.0

Discovery Timeline

• 2025-01-14 - CVE-2024-50349 published to NVD
• 2025-12-18 - Last updated in NVD database

Technical Details for CVE-2024-50349

Vulnerability Analysis

This vulnerability falls under CWE-116 (Improper Encoding or Escaping of Output). The core issue lies in how Git processes and displays URL-encoded data during terminal credential prompts. When a user attempts to clone or fetch from a repository that requires authentication, Git decodes URL-encoded characters before printing the hostname to the terminal. This behavior becomes dangerous when the URL contains encoded ANSI escape sequences.

ANSI escape sequences are special character combinations that terminals interpret as commands to manipulate display output—changing colors, moving the cursor, or clearing portions of the screen. By embedding these sequences in a malicious URL, an attacker can craft a prompt that appears to request credentials for a trusted domain like github.com while actually sending the credentials to an attacker-controlled server.

Root Cause

The root cause is insufficient output sanitization in Git's credential prompting mechanism. When Git decodes URL-encoded parts of the repository URL for display, it fails to filter or escape ANSI control characters before outputting them to the terminal. This allows the raw escape sequences to be interpreted by the terminal emulator, enabling visual manipulation of the credential prompt.

Attack Vector

The attack requires social engineering to convince a victim to clone a malicious repository URL. The attacker constructs a URL with carefully crafted ANSI escape sequences that, when decoded and displayed in the terminal:

1. Overwrite or hide the actual malicious hostname
2. Display a trusted hostname (e.g., github.com) in its place
3. Prompt the user for credentials that are then sent to the attacker's server

This attack is particularly effective during recursive clones where submodule URLs might not be carefully inspected by the user.

The vulnerability exploits the trust users place in terminal output. When a user sees a familiar hostname in the credential prompt, they are likely to enter their password without suspecting the display has been manipulated. The attacker's server then captures these credentials, potentially compromising access to the user's legitimate Git repositories.

Detection Methods for CVE-2024-50349

Indicators of Compromise

• Unusual or unexpected credential prompts when cloning repositories
• Repository URLs containing unusual URL-encoded characters or escape sequences
• Authentication requests to unfamiliar or suspicious hostnames appearing after repository operations
• Log entries showing credential transmission to unexpected endpoints

Detection Strategies

• Monitor Git operations for URLs containing encoded ANSI sequences (e.g., %1B, %5B, %0D, %0A)
• Implement endpoint detection rules to flag Git clone operations from untrusted or suspicious sources
• Review Git configuration and submodule URLs in existing repositories for malicious patterns
• Use credential helpers that do not rely on terminal prompts, reducing exposure to this vulnerability

Monitoring Recommendations

• Enable verbose logging for Git operations to capture full URL strings before credential prompts
• Deploy network monitoring to detect credential submission to unauthorized endpoints
• Implement terminal session recording for security-sensitive development environments
• Establish alerts for Git operations involving unfamiliar remote repository URLs

How to Mitigate CVE-2024-50349

Immediate Actions Required

• Upgrade Git to a patched version immediately: v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, or v2.40.4
• Avoid cloning repositories from untrusted or unfamiliar URLs until the update is applied
• Configure and use credential helpers instead of relying on terminal prompts for authentication
• Exercise caution with recursive clone operations, especially from external sources

Patch Information

The vulnerability has been addressed in Git commits 7725b81 and c903985. These fixes are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users should upgrade to one of these versions or later. Debian users should refer to the Debian LTS Announcement for distribution-specific update instructions. For complete details, see the GitHub Security Advisory GHSA-hmg8-h7qf-7cxr.

Workarounds

• Configure a credential helper (e.g., git config --global credential.helper cache or git config --global credential.helper store) to avoid terminal-based credential prompts
• Manually inspect repository URLs before cloning, especially checking for suspicious URL-encoded characters
• Use SSH-based authentication instead of HTTPS with password prompts where possible
• Avoid recursive cloning (--recursive) from untrusted sources until Git is updated

# Configure credential helper to avoid terminal prompts
git config --global credential.helper cache

# Or use SSH authentication instead of HTTPS
git config --global url."git@github.com:".insteadOf "https://github.com/"