Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers
概要
Git for Windows: git clone from manipulated repositories can leak NTLM hashes to arbitrary servers
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction. By brute-forcing the NTLMv2 hash (which is expensive, but possible), credentials can be extracted. This issue has been fixed in version 2.53.0.windows.3.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web learn.microsoft.com
- web support.microsoft.com
- web techcommunity.microsoft.com