PT-2026-89202 · Pypi · Githacker

CVE-2026-50024

·

Publicado

2026-09-09

·

Atualizado

2026-09-10

CVSS v3.1

5.3

Média

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns any 40-character hex substring into an outbound HTTP GET — an existence oracle for arbitrary paths plus hex-fragment exfiltration of file contents.

Details

Vulnerability

GitHacker rebuilds a remote .git/ by fetching files into temp dst. Two functions derived filesystem paths from server-controlled content:
  • add head file tasks reads the downloaded .git/HEAD, parses ref: <ref-path>, and joins the raw ref-path onto temp dst/.git/logs/ before reading the resulting file.
  • add hashes parsed scans any file it reads for 40-character hex substrings and emits GET .git/objects/<sha[0:2]>/<sha[2:]> for each one — onto the attacker's server and into the local output tree.
Pre-fix, add head file tasks did not validate the ref segments. A malicious .git/HEAD of
ref: ../../../../../../etc/passwd
caused add head file tasks to traverse out of temp dst and read /etc/passwd. The bytes flowed into add hashes parsed, which emitted one outbound HTTP request per 40-char-hex match — observable on the attacker's logs.

Impact

PR #65 originally classified this as arbitrary local file read. Joint analysis during coordinated disclosure narrowed the primitive: file contents do not stream back wholesale because the only egress channel is the 40-char-hex regex. In practice an attacker can:
  • Existence oracle for any path on the GitHacker host (/etc/shadow, /root/.ssh/id rsa, /home/<user>/.git-credentials, build artifacts under /tmp/).
  • Hex-fragment exfiltration when the targeted file contains 40-char hex sequences: other git repos' refs / pack filenames, password hashes, HMAC-SHA1 outputs, some session tokens.
Not exploitable without victim action: the attacker must persuade the victim to run GitHacker against a URL they control. Project guidance has always been to run GitHacker inside a disposable container.

Scoping note: no write-side primitive in 1.1.7

A working write-side primitive (attacker drops content outside temp dst via add folder / add task) does not reproduce against the shipped 1.1.7 source. Empirical testing by the reporter against GitHacker-1.1.7.tar.gz (25 traversal-style payloads including ....//, %2e%2e%2f, layered foo/../../, NUL bytes, backslash variants, absolute paths) yielded 0/25 escapes. Two structural reasons:
  1. add folder anchors every derived path on self.url + '.git/', so the first path component after the url length strip is always .git. os.path.join's absolute-path short-circuit never fires.
  2. Python's str.replace("..", "") is greedy non-overlapping; ....// collapses to //, ......// to ///, etc. No literal .. survives into add task.
5f2a8ba is still the correct fix for the read-side primitive and additionally hardens add task as defense in depth against future regressions — for example, if a later caller removes the .git/ anchor in add folder or wires a new server-controlled segment source into add task.

Fix

Commit 5f2a8ba introduces is safe path segment as a single trust boundary: every segment about to be joined onto temp dst or appended to an outgoing URL is validated against an allowlist before add task accepts it. Empty / . / .. / separators / NUL / control characters are rejected; the brittle replace("..", "") filter is removed.
The fix also tightens adjacent surfaces preemptively:
  • add folder switches to urlparse-based scheme + netloc + path comparison.
  • construct url from path components percent-encodes every segment.
PR #65's two-layer defense (allowlist regex + os.path.realpath() confinement) was consolidated onto the allowlist applied at queue-time, removing the TOCTOU window an after-the-fact realpath() check leaves open and the per-call-site drift risk. PR #65 was closed in favour of the broader fix.
Regression tests in [tests/test ref validation.py](https://github.com/WangYihang/GitHacker/blob/main/tests/test ref validation.py) (commit 16fcd81) pin the PoC and six bypass variants (extra-depth, mid-path, NUL, absolute path, leading-dot, .lock-suffix).

Credit

Reported and patched-prototyped by Zac Wang (@7a6163) in #65. Zac refined the impact framing from "arbitrary file read" to "existence oracle + hex-fragment exfiltration" and verified the absence of a write-side primitive against the shipped 1.1.7 sdist with a 25-payload harness.

Patches

Patched in 1.1.8 (commit 5f2a8ba; tests 16fcd81).

Workarounds

Run GitHacker inside a disposable container. Do not point GitHacker at any URL whose contents are not under your control.

Resources

Correção

Path traversal

Relative Path Traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22CWE-23

Identificadores relacionados

CVE-2026-50024
GHSA-HR3M-4QWQ-3MGC
PYSEC-2026-3835

Produtos afetados

Githacker