CyberRota Analysis
AI-GeneratedGit for Windows versions prior to 2.55.0.windows.4 are vulnerable to a remote code execution risk where a malicious Git server can exploit the bundle URI feature to initiate an outbound SMB connection, potentially exposing NTLM authentication credentials to an attacker-controlled host. Organizations using affected versions should prioritize updating to the fixed version to mitigate the risk of credential leakage and unauthorized access. This vulnerability is particularly critical for environments that rely on Git for version control and have sensitive authentication mechanisms in place.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.