CVE-2023-25815

Name of the Vulnerable Software and Affected Versions Git for Windows version 2.40.1

Description The issue is related to the gettext() function in Git for Windows, which uses a hard-coded path to look for localized messages. This allows low-privilege users to place fake messages in a specific location, potentially leading to social engineering attacks. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website. The attack vector is less likely due to the requirement of local write access by the attacker.

Recommendations For Git for Windows version 2.40.1, update to a newer version that contains a patch for this issue. As a temporary workaround, consider creating a C:mingw64 folder and leaving it empty to prevent low-privilege users from placing fake messages. Alternatively, users with administrative rights may remove the permission to create folders in C: to minimize the risk of exploitation. Do not work on a Windows machine with shared accounts to reduce the likelihood of this vulnerability being exploited.