CVE-2021-21237

low-risk
Published 2021-01-15

Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2.

Do I need to act?

-
0.20% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
LOCAL / HIGH complexity

Affected Products (1)

Git Large File Storage

Affected Vendors

Git Large File Storage Project

References (8)

Third Party Advisory https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955
Patch https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea7...
Third Party Advisory https://github.com/git-lfs/git-lfs/releases/tag/v2.13.2
Third Party Advisory https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5
Third Party Advisory https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955
Patch https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea7...
Third Party Advisory https://github.com/git-lfs/git-lfs/releases/tag/v2.13.2
Third Party Advisory https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5
25
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal