Git Recursive Clone Submodule Hook RCE
- Product
- Git Git
- CVE
- CVE-2024-32002
- Disclosed
- 2024-05-14
- CVSS
- 9
- Auth
- requires auth / interaction
- CISA KEV
- no
- Affected
- Git < 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, 2.39.4 (on case-insensitive filesystems with symlinks)
- Fixed
- 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, 2.39.4
Summary
Cloning a malicious repository with --recursive could execute code during the clone itself on Windows and macOS. Amal Murali published the exploit, which abuses submodules, symlinks and case-insensitive filesystems.
Root cause
On case-insensitive filesystems, a symlink whose name differs only in case from a submodule path tricks Git into writing the submodule's contents into the .git/ directory instead of the worktree. This lets the attacker plant a hook (e.g. post-checkout) that Git executes while the clone is still running.
Impact
Code execution on a developer or CI machine just by cloning a repository recursively.
Detection
Check git --version on Windows/macOS workstations and CI runners; inspect repositories for submodule paths colliding case-insensitively with symlinks.
Mitigation
Upgrade Git; as a workaround disable symlinks (core.symlinks=false) and avoid --recursive clones of untrusted repos.