# CVE-2024-32002

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

- Page: https://www.vulneraibility.com/cve/CVE-2024-32002
- CVSS: 9.0
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 29.23% (percentile 98.2)
- Unvetted proof-of-concept code on GitHub: 64 GitHub proofs of concept (first 2024-05-17)
- CISA SSVC: exploitation poc, automatable no, technical impact total (assessed 2024-05-29)
- Weakness: CWE-22, CWE-434
- Published: 2024-05-14

## Affected versions

- git: affected = 2.45.0; = 2.44.0; >= 2.43.0 and < 2.43.4; >= 2.42.0 and < 2.42.2; = 2.41.0; >= 2.40.0 and < 2.40.2; < 2.39.4

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv
- [other] https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d
- [other] https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt
- [other] https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/
- [other] http://www.openwall.com/lists/oss-security/2024/05/14/2
- [other] https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
- [other] https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.