Git Credential Handling Vulnerability Allows Credential Misleading via Control Sequences

A vulnerability in Git's credential handling can mislead users into providing sensitive information, such as passwords, for trusted Git hosting sites. This occurs when Git prompts for credentials in the terminal without using a credential helper. The vulnerability is present in Git versions 2.48.0 through 2.47.1, 2.46.2 through 2.45.2, 2.44.2, 2.43.5, 2.42.3, 2.41.2, and 2.40.3. During the credential prompt, Git prints the host name with any URL-encoded parts decoded, allowing attackers to craft URLs with ANSI escape sequences. These sequences can confuse users into sending passwords to untrusted sites under the attacker's control.

Impact

Exploitation of this vulnerability can lead to unintentional disclosure of credentials to malicious sites, potentially allowing attackers to impersonate users on trusted Git platforms.

Reproduction

The vulnerability can be reproduced by configuring a Git credential helper to send control characters in the username, which will be displayed in the password prompt. This can be done by setting up a test repository that requires authentication and using a credential helper script that includes control characters. When Git prompts for the password, the control characters can be interpreted by the terminal, leading to confusion and misdirection of credentials.

Remediation

Users should upgrade to Git versions 2.48.1, 2.47.2, 2.46.3, 2.45.3, 2.44.3, 2.43.6, 2.42.4, 2.41.3, or 2.40.4. For those unable to upgrade, it is advised to avoid cloning from untrusted URLs, especially when recursive clones are involved.