{"thread":{"id":"52634","subject":"Can Git repos be hacked or otherwise manipulated?","startedAt":"2020-01-14T14:48:11Z","lastAt":"2020-01-16T20:15:58Z","messageCount":6,"participants":["1234dev","Jeff King","Jonathan Nieder","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"389745","messageId":"fOv65WlolaWZ638trkwZ6nnWIaRu14wx8bYkLdqzidlHPvhYpg1f6TSa_Z7w7iFEsXSLkMzQ6EYTwo3ggF3oXrDh5U4LM_i2Rzx0BkMh7zI=@protonmail.com","threadId":"52634","inReplyTo":null,"subject":"Can Git repos be hacked or otherwise manipulated?","fromName":"1234dev","fromEmail":"1234dev@protonmail.com","sentAt":"2020-01-14T14:48:05Z","receivedAt":"2020-01-14T14:48:11Z","isPatch":false,"sender":{"key":"1234dev@protonmail.com","avatar":null},"body":"Hi,\n\nLet's say you're working with a team of elite hackers, passing a tarball of a Git repo back and forth as you complete your mission. Now let's say one of them has malicious intent. What are the possibilities that he or she can, for instance, hide changes made to a script or binary that does something malicious if executed? Or perhaps maybe there are other such scenarios one should be made aware of?\n\nThanks and have a nice day!\n\n--Jonathan\n\nSent with ProtonMail Secure Email.\n"},{"id":"389790","messageId":"20200114220826.GB3957260@coredump.intra.peff.net","threadId":"52634","inReplyTo":"fOv65WlolaWZ638trkwZ6nnWIaRu14wx8bYkLdqzidlHPvhYpg1f6TSa_Z7w7iFEsXSLkMzQ6EYTwo3ggF3oXrDh5U4LM_i2Rzx0BkMh7zI=@protonmail.com","subject":"Re: Can Git repos be hacked or otherwise manipulated?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2020-01-14T22:08:26Z","receivedAt":"2020-01-14T22:08:29Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Jan 14, 2020 at 02:48:05PM +0000, 1234dev wrote:\n\n> Let's say you're working with a team of elite hackers, passing a\n> tarball of a Git repo back and forth as you complete your mission. Now\n> let's say one of them has malicious intent. What are the possibilities\n> that he or she can, for instance, hide changes made to a script or\n> binary that does something malicious if executed? Or perhaps maybe\n> there are other such scenarios one should be made aware of?\n\nIt is absolutely not safe to run Git commands from a tarball of an\nuntrusted repo. There are many ways to execute arbitrary code specified\nby a config option, and you'd be getting recipients .git/config.\nLikewise for hooks.\n\nAnd while we would consider it a bug if you can trigger a memory error\nby reading a corrupted or malicious on-disk file, that's gotten _way_\nless auditing than the code paths which take in objects from a remote.\nSo e.g., I would not be surprised if there are vulnerabilities that\ncould cause out-of-bounds reads of a corrupted .git/index.\n\n-Peff\n"},{"id":"389798","messageId":"bvMqhQOr4uENl8j2zcFOY0ogJmUqTRofCGyPlPc_xaXQXSP5ds9lgdglXkjTZng9U5WSpo-Uc2_SzCTdpAvLTeruT-tW3GTDkWj9dfLznuM=@protonmail.com","threadId":"52634","inReplyTo":"20200114220826.GB3957260@coredump.intra.peff.net","subject":"Re: Can Git repos be hacked or otherwise manipulated?","fromName":"1234dev","fromEmail":"1234dev@protonmail.com","sentAt":"2020-01-15T03:18:34Z","receivedAt":"2020-01-15T03:18:41Z","isPatch":false,"sender":{"key":"1234dev@protonmail.com","avatar":null},"body":"Hello Jeff and thank you for your response!\n\nTo work around this problem, should we instead host this repo on a public service? If so which one would you recommend?\n\n--Jonathan\n\nSent with ProtonMail Secure Email.\n\n‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐\nOn Tuesday, January 14, 2020 10:08 PM, Jeff King <peff@peff.net> wrote:\n\n> On Tue, Jan 14, 2020 at 02:48:05PM +0000, 1234dev wrote:\n>\n> > Let's say you're working with a team of elite hackers, passing a\n> > tarball of a Git repo back and forth as you complete your mission. Now\n> > let's say one of them has malicious intent. What are the possibilities\n> > that he or she can, for instance, hide changes made to a script or\n> > binary that does something malicious if executed? Or perhaps maybe\n> > there are other such scenarios one should be made aware of?\n>\n> It is absolutely not safe to run Git commands from a tarball of an\n> untrusted repo. There are many ways to execute arbitrary code specified\n> by a config option, and you'd be getting recipients .git/config.\n> Likewise for hooks.\n>\n> And while we would consider it a bug if you can trigger a memory error\n> by reading a corrupted or malicious on-disk file, that's gotten way\n> less auditing than the code paths which take in objects from a remote.\n> So e.g., I would not be surprised if there are vulnerabilities that\n> could cause out-of-bounds reads of a corrupted .git/index.\n>\n> -Peff\n\n\n"},{"id":"389799","messageId":"20200115034341.GA218782@google.com","threadId":"52634","inReplyTo":"bvMqhQOr4uENl8j2zcFOY0ogJmUqTRofCGyPlPc_xaXQXSP5ds9lgdglXkjTZng9U5WSpo-Uc2_SzCTdpAvLTeruT-tW3GTDkWj9dfLznuM=@protonmail.com","subject":"Re: Can Git repos be hacked or otherwise manipulated?","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2020-01-15T03:43:41Z","receivedAt":"2020-01-15T03:43:45Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi,\n\n1234dev wrote:\n> Jeff King wrote:\n\n>> It is absolutely not safe to run Git commands from a tarball of an\n>> untrusted repo. There are many ways to execute arbitrary code specified\n>> by a config option, and you'd be getting recipients .git/config.\n>> Likewise for hooks.\n\n(By the way, this is an area of active work.  If you'd like to help,\nthat's welcome. :) See also\nhttps://lore.kernel.org/git/20171002234517.GV19555@aiede.mtv.corp.google.com/\nand https://lore.kernel.org/git/20191116011125.GG22855@google.com/.)\n\n>> And while we would consider it a bug if you can trigger a memory error\n>> by reading a corrupted or malicious on-disk file, that's gotten way\n>> less auditing than the code paths which take in objects from a remote.\n>> So e.g., I would not be surprised if there are vulnerabilities that\n>> could cause out-of-bounds reads of a corrupted .git/index.\n\nCc-ing Josh Steadmon in case he has pointers for how to add some fuzz\ntests to harden this kind of thing.  We definitely want to find any\nvulnerabilities in this area.  (In addition to the case of \"ask a\nfriendly sysadmin or member of GitHub tech support to debug my broken\nrepo\", this also would affect any users collaborating on a repository\non a shared filesystem.)\n\n[...]\n> To work around this problem, should we instead host this repo on a\n> public service? If so which one would you recommend?\n\nIf you want to use ordinary file transfer mechanisms to share a\nrepository, you can use \"git bundle\" to create a copy of your Git repo\nin a form that is meant to be safe and straightforward to pass around.\nSee \"git help bundle\" for more details.\n\nThanks and hope that helps,\nJonathan\n"},{"id":"389806","messageId":"20200115180140.GA4081287@coredump.intra.peff.net","threadId":"52634","inReplyTo":"bvMqhQOr4uENl8j2zcFOY0ogJmUqTRofCGyPlPc_xaXQXSP5ds9lgdglXkjTZng9U5WSpo-Uc2_SzCTdpAvLTeruT-tW3GTDkWj9dfLznuM=@protonmail.com","subject":"Re: Can Git repos be hacked or otherwise manipulated?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2020-01-15T18:01:40Z","receivedAt":"2020-01-15T18:01:43Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Jan 15, 2020 at 03:18:34AM +0000, 1234dev wrote:\n\n> To work around this problem, should we instead host this repo on a\n> public service? If so which one would you recommend?\n\nOops, I forgot to mention the actual solution. :)\n\nGenerally it is safe to clone _from_ an untrusted repo, even if it's on\na local filesystem. So untarring the repo and running:\n\n  git clone evil.git safe\n  cd safe\n  git log\n\nshould make it OK to run Git commands inside the \"safe\" directory.\n\nJonathan Nieder also mentioned using a bundle file, which may be even\nsimpler, as it skips the part where you have to deal with tar. :)\n\nRun:\n\n  git bundle create foo.bundle --all\n\non the sending side, and then you can just:\n\n  git clone foo.bundle safe\n\non the receiving side.\n\n-Peff\n"},{"id":"389915","messageId":"xmqqsgkfgnt6.fsf@gitster-ct.c.googlers.com","threadId":"52634","inReplyTo":"20200115180140.GA4081287@coredump.intra.peff.net","subject":"Re: Can Git repos be hacked or otherwise manipulated?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2020-01-16T20:15:49Z","receivedAt":"2020-01-16T20:15:58Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jeff King <peff@peff.net> writes:\n\n> On Wed, Jan 15, 2020 at 03:18:34AM +0000, 1234dev wrote:\n>\n>> To work around this problem, should we instead host this repo on a\n>> public service? If so which one would you recommend?\n>\n> Oops, I forgot to mention the actual solution. :)\n>\n> Generally it is safe to clone _from_ an untrusted repo, even if it's on\n> a local filesystem. So untarring the repo and running:\n>\n>   git clone evil.git safe\n>   cd safe\n>   git log\n>\n> should make it OK to run Git commands inside the \"safe\" directory.\n\nThen there are those who are even more paranoid to consider that\nforeign bits hitting their disk platter ^W^W working tree poses\nrisks (e.g. by background thumbnailers crawling there, getting\nexploited by checked out payload that are not trustworthy).\n\n;-)\n"}]}