Listen to this Post
How the CVE Works
The vulnerability exploits GitHub’s incomplete validation of Git push packfiles. When a user pushes changes, GitHub’s proxy only verifies the `ref-update` line (oldOid → newOid) without inspecting the full packfile contents. The server runs `git rev-list oldOid..newOid` to track new commits but doesn’t enforce that the packfile exclusively contains those commits. Attackers can append additional (“hidden”) commits to the packfile, which GitHub stores and serves via direct SHA URLs—bypassing branch visibility. These commits remain accessible but don’t appear in repository history, enabling stealthy data exfiltration.
DailyCVE Form
Platform: GitHub
Version: Pre-patch
Vulnerability: Commit injection
Severity: High
Date: 2023-XX-XX
Prediction: Patch by Q4 2023
What Undercode Say
Analytics:
git rev-list --objects --no-object-names "^${ORIG_COMMIT}" ${NEW_COMMIT} > objects.txt
git pack-objects --stdout < objects.txt > packfile
curl -u ${USER}:"$(<~/.github-test-pat)" -X POST "${REMOTE_URL}/git-receive-pack" --data-binary @output
How Exploit
1. Clone target repo, create visible/hidden commits.
2. Push visible commit via `git push`.
- Craft malicious packfile with hidden commit using
git pack-objects.
4. Send via `curl` to `git-receive-pack`.
Protection from this CVE
- GitHub: Validate packfile contents match
ref-update. - Users: Audit unreferenced commits via
git fsck.
Impact
- Confidentiality: Secret leaks via hidden commits.
- Persistence: Commits remain until GC.
- Detection: No UI traces.
No references provided in original .
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
