Awlex

3y

That might seem a bit random, but I started off this year with a nightmare (a literal dream) where I've fallen victim to remote code execution, because I cloned someone's git repo.

Is such a thing even possible? The closest thing I've found was this blog
https://blog.blazeinfosec.com/attac...
(and the info on it was already worrying enough), but that shouldn't have affected my dream computer.

Some details I more or less remember:
* The execution happened right after git clone
* The uri to the repo was a custom domain (no github, gitlab or anything)
* no submodules
* GNU/Linux

question

Ranter

Comments

0

AlmondSauce

16395

3y

Nah, not possible unless you either ran a program or opened a file you cloned - or of course git has a major unknown security hole that allows that to happen.
0

Hazarth

9476

3y

Nope, you're safe from *git*

However, everytime you run foreign code as admin/root you might as well give your computer to the programmers hands.

But none of us are going to comb the code of every repo we ever build and run so.... We just have to trust each other and the Issues tab
0

Oktokolo

12122

3y

Definitely possible when you don't just clone a repo for the cloning experience but to actually work with its content - especially, when the content is code, which you use verbatim or modified for something...

And then there also was an RCE bug in the submodules feature:
https://cvedetails.com/cve/...

devRant © 2021 Hexical Labs LLC
Privacy Policy | Terms of Service