Multiple Git flaws led to credentials compromise
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-52006 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to inte Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. NVD description · AI analysis pending | 2.1 | 1% |
| — | ||
| CVE-2024-53263 | Git LFS is a Git extension for versioning large files. Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time. NVD description · AI analysis pending | 8.5 | 1% | — | — | ||
| CVE-2024-53858 | The gh cli is GitHub’s official command line tool. The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI commands invoke git with instructions to retrieve authentication tokens using the `credential.helper` configuration variable for any host encountered. Prior to version `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage: 1. `GITHUB_ENTERPRISE_TOKEN`, 2. `GH_ENTERPRISE_TOKEN` and 3. `GITHUB_TOKEN` when the `CODESPACES` environment variable is set. The result being `git` sending authentication tokens when cloning submodules. In version `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com. Users are advised to upgrade. Additionally users are advised to revoke authentication tokens used with the GitHub CLI and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise NVD description · AI analysis pending | 6.5 | <1% | — | — | ||
| CVE-2025-23040 | GitHub Desktop is an open-source Electron-based GitHub app designed for git development. GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote which requires authentication it will request the credentials for that remote host from GitHub Desktop using the git-credential protocol. Using a maliciously crafted URL it's possible to cause the credential request coming from Git to be misinterpreted by Github Desktop such that it will send credentials for a different host than the host that Git is currently communicating with thereby allowing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitHub Desktop could be improperly transmitted to an unrelated host. Users should update to GitHub Desktop 3.4.12 or greater which fixes this vulnerability. Users who suspect they may be affected should revoke any relevant credentials. NVD description · AI analysis pending | 6.6 | <1% | — | — |
Full article465 words · extracted from securityaffairs.com · click to collapse
Vulnerabilities in the Git credential retrieval protocol could have allowed threat actors to access user credentials.
Security researcher RyotaK from GMO Flatt Security Inc discovered multiple vulnerabilities in the Git credential retrieval protocol that could have allowed threat actors to access user credentials.
The vulnerabilities stem from the improper handling of messages in Git’s credential retrieval protocol.
In October 2024, the researcher while hunting bugs for the GitHub Bug Bounty program shifted focus from GitHub Enterprise Server to GitHub Desktop. Upon reviewing its source code, he discovered a bug allowing malicious repositories to leak user credentials. Intrigued, the expert decided to analyze other Git-related projects, uncovering several additional vulnerabilities.
The Git Credential Protocol was used to retrieve credentials from helpers like git-credential-store and git-credential-osxkeychain, the researcher RyotaK discovered multiple flaws causing credential leakage.
Git retrieves credentials from helpers by exchanging structured messages separated by newline characters. To prevent property injection, Git blocks newline and NULL bytes in property names and values.
The researcher discovered that GitHub Desktop’s credential helper, “trampoline,” improperly handled the Git Credential Protocol due to differences in how line terminators (\n, \r, etc.) were processed. An attacker can use a crafted URL with carriage return (%0d) to manipulate how the credentials are parsed. This caused GitHub Desktop to associate credentials with the wrong host (e.g., github.com instead of localhost), leading to credential leaks.
This GitHub Desktop improper regular expression issue has been tracked as CVE-2025-23040.
The researcher also reported a Git LFS newline injection, tracked as CVE-2024-53263, that could lead to credential compromise.
The Git’s researchers addressed the vulnerabilities caused by carriage return smuggling, and tracked by the organization as CVE-2024-52006), by introducing a defense-in-depth measure by validating the credential protocol. A new credential.protectProtocol configuration, enabled by default, blocks URLs containing carriage return characters (\r). This patch mitigates potential credential leaks across all credential helpers, including Git LFS.
GitHub CLI was found to leak access tokens to arbitrary hosts (CVE-2024-53858) due to a logic flaw in its tokenForHost function. While not affected by carriage return smuggling, the IsEnterprise function incorrectly classified non-GitHub-owned hosts as enterprise hosts, allowing access tokens (e.g., GH_ENTERPRISE_TOKEN or GITHUB_TOKEN) to be sent to malicious hosts. The expert pointed out that the flaw is especially critical in GitHub Codespaces, where the CODESPACES environment variable is always set to true, enabling token leakage when cloning malicious repositories.
“As we saw, text-based protocols are often vulnerable to injection, and a small architecture flaw can lead to a big security issue.” reads the report published by the researcher. “I hope that this research helped the Git community to improve its security, and I am looking forward to seeing further research on Git-related projects.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, credential leakage)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/173520/security/multiple-git-flaws-led-to-credentials-compromise.html