Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers
Résumé
Git for Windows: git clone from manipulated repositories can leak NTLM hashes to arbitrary servers
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction. By brute-forcing the NTLMv2 hash (which is expensive, but possible), credentials can be extracted. This issue has been fixed in version 2.53.0.windows.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web learn.microsoft.com
- web support.microsoft.com
- web techcommunity.microsoft.com