Learn More
Resend Email
5
Awlex
2y

That might seem a bit random, but I started off this year with a nightmare (a literal dream) where I've fallen victim to remote code execution, because I cloned someone's git repo.

Is such a thing even possible? The closest thing I've found was this blog
https://blog.blazeinfosec.com/attac...
(and the info on it was already worrying enough), but that shouldn't have affected my dream computer.

Some details I more or less remember:
* The execution happened right after git clone
* The uri to the repo was a custom domain (no github, gitlab or anything)
* no submodules
* GNU/Linux

question
Favorite
Ranter
Comments
  • 0
    2y
    Nah, not possible unless you either ran a program or opened a file you cloned - or of course git has a major unknown security hole that allows that to happen.
  • 0
    2y
    Nope, you're safe from *git*

    However, everytime you run foreign code as admin/root you might as well give your computer to the programmers hands.

    But none of us are going to comb the code of every repo we ever build and run so.... We just have to trust each other and the Issues tab
  • 0
    2y
    Definitely possible when you don't just clone a repo for the cloning experience but to actually work with its content - especially, when the content is code, which you use verbatim or modified for something...

    And then there also was an RCE bug in the submodules feature:
    https://cvedetails.com/cve/...
devRant © 2021 Hexical Labs LLC
Privacy Policy  |  Terms of Service
Add Comment