Git CVE-2024-32002 Remote Code Execution Vulnerability Analysis

This article analyzes the Git CVE-2024-32002 remote code execution vulnerability. The vulnerability allows attackers to execute malicious code on victims' computers simply by cloning a specially crafted Git repository. The article explains the vulnerability's working principle, which exploits Git hooks, submodules, and symbolic links to write malicious code into the .git directory.

The article covers several key concepts: Git hooks (pre-commit, post-commit, etc.), Git submodules, and symbolic links. It explains how the attack works by creating a Git project with a submodule that points to a malicious repository, combined with a symbolic link that exploits case-insensitive file systems to write to the .git directory.

The vulnerability affects Git versions v2.45.0, v2.44.0, <=v2.43.3, <=v2.42.1, v2.41.0, <=v2.40.1, and <=v2.39.3. The article provides a detailed analysis of the attack chain and recommends users check their Git version and update if necessary.

The article concludes with a warning about being cautious with Git repositories from unknown sources and provides a demonstration of the vulnerability's impact.