CVE-2014-9390

Root

Cause This vulnerability affects Git versions before 1.8.5.6, 1.9.5, 2.0.5, 2.1.4, 2.2.1, and many other Git-compatible tools including Mercurial, Xcode, libgit2, Egit, and JGit when running on case-insensitive file systems (Windows NTFS/FAT, OS X HFS+). The core issue is that these clients fail to properly validate paths within a Git tree. By crafting a tree containing a file that, on a case-insensitive filesystem, maps to .git/config (e.g., using Unicode homoglyphs, the 8.3 short filename git~1/config, or mixed case like .GIT/config), an attacker can cause the client to overwrite the local repository's configuration file during clone or checkout operations [1][3].

Exploitation

Exploitation requires an attacker to host a malicious Git repository or convince a victim to clone/checkout from such a repository. No authentication is needed beyond access to the remote repo. The vulnerability triggers automatically when the client processes the malicious tree on a case-insensitive filesystem. The attack does not require user interaction beyond the normal clone or checkout command [2][3].

Impact

An attacker who successfully overwrites .git/config can inject arbitrary Git configuration directives, such as setting core.gitproxy or core.sshCommand, to execute arbitrary commands on the victim's machine. This results in full remote code execution in the context of the user running the Git client. The attack is particularly severe because it can compromise developer workstations, potentially leading to credential theft or supply-chain attacks [3][4].

Mitigation

The vulnerability is patched in Git versions 1.8.5.6, 1.9.5, 2.0.5, 2.1.4, 2.2.1, and later. GitHub blocked malicious trees from being pushed to its servers. Apple addressed the issue in Xcode 6.2 beta 3 [4]. Users should update all Git clients immediately and avoid cloning from untrusted repositories on affected operating systems. Linux systems on case-sensitive filesystems are not vulnerable [3].