CVE-2024-53263: Git LFS Credential Disclosure Vulnerability

CVE-2024-53263 Overview

CVE-2024-53263 is a credential disclosure vulnerability in Git Large File Storage (Git LFS), a Git extension for versioning large files. The flaw allows an attacker to retrieve a user's Git credentials by embedding URL-encoded line feed (LF) or carriage return (CR) control characters in a remote host URL. Git LFS passes portions of the host URL to the git-credential(1) command without validating embedded control characters, then forwards any credentials returned by the helper back to the attacker-controlled remote. The issue affects all versions prior to v3.6.1 and is classified under [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
Attackers can exfiltrate Git credentials by crafting malicious repository URLs containing encoded newline characters, enabling theft of authentication material for arbitrary Git hosts.

Affected Products

Git LFS all versions prior to v3.6.1
Debian LTS packaged distributions of git-lfs
Any platform or CI/CD pipeline integrating vulnerable Git LFS clients

Discovery Timeline

2025-01-14 - CVE-2024-53263 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53263

Vulnerability Analysis

Git LFS communicates with the git-credential helper using a newline-delimited key/value protocol. When Git LFS needs credentials for a remote host, it serializes URL components such as the protocol, host, and path into this protocol stream. The vulnerable code in creds/creds.go writes user-controlled values directly into the credential request buffer without checking for embedded \n or \r bytes.

An attacker who can supply a Git LFS remote URL, for example through a malicious repository, submodule, or .lfsconfig entry, can inject additional protocol fields. By terminating the host field early and appending a forged host= line pointing at a different domain, the attacker causes the credential helper to return credentials stored for an unrelated host. Git LFS then transmits those credentials back to the attacker's server. This vulnerability has an EPSS score of 1.04%.

Root Cause

The root cause is missing input neutralization (CWE-74) in the Creds.buffer() function. URL fields parsed from a remote target are written into the credential helper protocol stream without rejecting line-ending control characters, allowing protocol smuggling into a downstream parser.

Attack Vector

The attack requires user interaction: the victim must clone or fetch from an attacker-influenced URL. The URL embeds URL-encoded %0A or %0D sequences that decode into LF or CR bytes when passed to the credential helper, smuggling additional host= or protocol= lines.

// Patch in creds/creds.go: reject LF bytes in credential data
 return slices.Contains([]string{"1", "true"}, FirstEntryForKey(c, "continue"))
 }
 
-func (c Creds) buffer() *bytes.Buffer {
+func (c Creds) buffer() (*bytes.Buffer, error) {
 	buf := new(bytes.Buffer)
 
 	buf.Write([]byte("capability[]=authtype\n"))
 	buf.Write([]byte("capability[]=state\n"))
 	for k, v := range c {
 		for _, item := range v {
+			if strings.Contains(item, "\n") {
+				return nil, errors.Errorf(tr.Tr.Get("credential value for %s contains newline: %q", k, item))
+			}
+
 			buf.Write([]byte(k))
 			buf.Write([]byte("="))
 			buf.Write([]byte(item))
 			buf.Write([]byte("\n"))
 		}
 	}
 
-	return buf
+	return buf, nil
 }

Source: Git LFS commit 0345b6f

Detection Methods for CVE-2024-53263

Indicators of Compromise

Git LFS remote URLs containing URL-encoded control characters such as %0A, %0D, or %00 in the host or path segments.
Outbound HTTPS connections from developer or CI hosts to unrecognized domains immediately following a git clone or git lfs fetch operation.
.lfsconfig files in untrusted repositories that define remotes with non-standard URL syntax.

Detection Strategies

Inspect Git LFS process command lines and child git-credential invocations for URL arguments containing encoded newline sequences.
Audit version strings of installed git-lfs binaries across developer workstations and build agents; flag any release earlier than v3.6.1.
Correlate credential helper invocations with subsequent outbound network connections to non-corporate Git hosts.

Monitoring Recommendations

Enable command-line argument logging for git and git-lfs processes on endpoints and CI runners.
Monitor and alert on cloning operations targeting URLs with percent-encoded control bytes.
Track changes to .gitconfig, .lfsconfig, and .gitmodules files in shared repositories.

How to Mitigate CVE-2024-53263

Immediate Actions Required

Upgrade all Git LFS installations to v3.6.1 or later on developer workstations, build servers, and container images.
Apply Debian LTS security updates for git-lfs as described in the Debian LTS Announcement.
Rotate any Git credentials that may have been exposed to untrusted remotes since the affected versions were deployed.
Audit CI/CD pipelines that perform git lfs operations against externally controlled URLs.

Patch Information

The fix is included in Git LFS v3.6.1, published as GitHub Release v3.6.1. The patched Creds.buffer() function now returns an error whenever a credential value contains an LF byte, preventing protocol smuggling. Full technical details are available in the GitHub Security Advisory GHSA-q6r2-x2cc-vrp7.

Workarounds

No vendor-supplied workarounds exist. Upgrading to v3.6.1 is the only supported remediation.
As a temporary control, restrict Git LFS use to known, trusted remote hosts and block clones of arbitrary external URLs from privileged build environments.
Configure credential helpers to scope stored credentials narrowly per host, limiting the blast radius of any single-host disclosure.

bash

# Verify the installed Git LFS version and upgrade if needed
git lfs version

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade git-lfs

# macOS (Homebrew)
brew update && brew upgrade git-lfs

# Confirm the patched release is in use
git lfs version | grep -E 'git-lfs/3\.(6\.[1-9]|[7-9])'