#VU102870 Improper Encoding or Escaping of Output in Git - CVE-2024-50349

Vulnerability identifier: #VU102870

Vulnerability risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50349

CWE-ID: CWE-116

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Git
Client/Desktop applications / Software for system administration

Vendor: Git

Description

The vulnerability allows a remote attacker to perform spoofing  attack.

The vulnerability exists due to incorrect handling of control sequences in account names when asking for credentials. A remote attacker can trick the victim into clicking on a specially crafted URL and trick users into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Git: 2.40.0 - 2.48.0

---

External links
https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr
https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8
https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.