安全研究
CVE-2024-32002 Git 子模块 + Symlink RCE：git clone –recursive 触发的任意代码执行
Thinking
2024-05-15
3 分钟阅读
研究档案
#漏洞分析#代码审计#供应链攻击
Git 在 recursive clone 时会执行 submodule 的 post-checkout hook，攻击者构造带 symlink 的恶意仓库能在 clone 阶段直接 RCE，连上马都不用。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237686cd8a2a6a0cc05eab1afba11e5ef42fc741aea3151000640ef1312c2114a04e44b601a3d2c7021ecaf4e78066c729e90ad86fd8587fc9cc44e067fc941b7aa685eaca17628280294003e00f56f5c089e1b3e3a110a923b1ff6bd04f72345ba214e9b277c8288cb41554365e3b14c1888f0c9ad4f7b710da8f490623632ae6a2f24603942c8ba9cd67ee2882dac2e761bc52d4dad45441d6f8e676b3fec963b7db1cc763e17f22bde8de89d48c8c412ea1b3c4c5f873f69dcc9dfb6b0148db6c03dcd54a4438d164569cd65cafef26ec46d72d97311898f176df8c8727077ed3b97b20ae1665cf6bbd6fd42622fbef566adb7fa826e7f7202905ebf9e08de68aee504a1843c3c1fa0f4def6936d24638ce462fa494af248d7c2a23e195953adfd913328d5220bc4bc5db290f794f494e7ecad8a92646afb7bc6473ad3a67787a895b33dd024ee9fba9cc184b2a73216c9cd1e90617ec2686abf64a35517b3c22ad90b7f052866dea0e79c391564990202bd7497327d9f91834bd89bd6612440da6d7ce8bee9ba90c9c21c608365cce15e4b025207ab1e790a4fcc54b6e7cce2548125a57a23af54d7dfe0ed74ee49958cad37c27374084d5b89fd9195c63911ff938c5a05582de059d4ead0dd9d8f00888353074e4f6ade02ca8b4eb2d1956e86dc758a2473bf01045147f9f9253f97c31377a491f7f2b6b10b0c68ef9101a5529bc6136eb6890f6307bfa8c937b8832fa143a0740f747abdae5881ebfe30c6a959f64fda5fc1cca6d770894bd509c94ac09d307b67ff1ff937d533bc1ec746e35141c7bf38bb7a75164a1efd7218ecfacc79a1d40864a54f34e31dcb32a265ca26caff0ae961eca39c1def7bcfc4fa435a24e6ead2c46d07d8606cbcc94dd1c167c576ea841b495853ceecddb45a8d149395c22d00201223bea97c5110b645b1c8c101b2c5a54291efd95bb90497707159c3abf75011fa108d4585aa787d6089ee5862f0eaf431de1262c2efb3d068f75a3c4a0f4e1a24102cff6d46b2cf4b55979d994c619272ad456137adeaea0fe7d3b33ea63cb639133074771c2ae23794a893c004c5b0a9f8a22695fafa3b97472a2e9e1fc781e920d2de76585df8bd88d0ab7cef54e429ce4c19a0946dde980fcc3b68a59084292b20017d04d32435be8db5b43305f742724631a435a3304158d34858a31ad6371c509fc5aef0c6cd2522499c3080d9dffed0a5d77d2fcb3470e6596d5c252a6e5a86fb744a9d4c5d995deb80c0698803570eb77366a0d1397fce71f540a8d418f5803c7237bb22959413f6fae8ddd52c5506b55fef5bafd023556c1969318c163e900db54c94b01e2456e4564e9ca5c2ee3c67ce088d7f78dfcd05ab63053e918898eec3d5ce2f61b2a5d3b3d2592c6996e33db7c51bfe22b0be5bcaf4ea02fbf2e23e7e61a78d7343c2f85270b3cbd093392822e3191227b0c7b5aba14acdf57df37c4d43bdc321aade273aa60a6d0f7ef7a938aa83002483037c6ce68eef4d077556d751745d51d83815171996e6858b7b3a0298fc329c47f3fcf4e779848f02f09038751950229cbc4bb5c9a2744ae0edccc61a7e5a0a682013eb5991904c824f41a5e315791916b8d875f2da6e551ed46bd462dd15fac31e06c265042aaa2126844610c23692cf9d62ade3fe6239989d6135eba3d65eadd13442473b36eadc2bb57428c0435a1976e34352d700514611e5eca25522dc09e0009ad6d25b8dcf94dd24657c8ee6bf056c5922a48e4e221c8341ed0aa367206a226a6b8d4fa8e75498224e4ebe371aeaac491e21b18fb0b24653277be1ed93141f45eedf00118524db1658bca89508087267692d7c692321cae7f9b9b9792e9a94b41d62190c66a03f2e7d32cf55d5734a55220438c03e8329e13603b9c6223b188d2fc52de8c0b1f0ff2a6dea1ae917ad26a1ee5b00a43c5ff12d5f264aeddac992c2d262baa196e0c0c7b729af0d06902457043325a31cec9195173188e81d464963360407a89007da9ca513def73e2cee21f8d89c0bf42a2d0e8705e0298455adffb78bfc2afcbcc3df3d1b346c3359f6b58c66ecc742cc59e1dd5283eb38c0a0e55c01e7ed3e01dec5c60e209222fcd9589c6bb5305d1d7e2da0e6cd9e889ffeca48602bd7683c5cc3d3b979c27eddef3b911a93f7a345ea9da94854b4f706165d612bc2016aee43766b49bc225a6b0294a9156b2943ceda7d0ba80553797e1b0e333e3f9779a7220577152a457346988a116847de3bae568e930c67683ab75610cc1946168cca8ec698588be1f75b5becff16b0e3ca842e04f482997254535f061f2220ee49b211c743f51fc9184d3845f05463b5ce46e78e407dd15501cc734d3f83d04148d2c86d9327102d3869f3bfd5a423465719167f2376205993003421cf34880627305f38efe0de90b4331e34c340678bbdc5e2fda6c7edb225939c8f182a7d83d578156801df3748d969016b514d52e096d50bf40b18ae226c871cb93423e703755f9b26fac8c9e89090b53a056c15e7dc6334d0f273574b193f4d36be2b97d7cd9a42c989f5116f2866d964852b4f4e57372af96ceb0aeb659c7716d543745fc0539a73bd8039072c6b878b5274e0186c3804a3bc4a47d155b7393fc427d62369c6571bf9e45b00f2a26ed2b765e55c4f045e5689706f240e709f95c5070181bab473be339a156b63d5af5d406b71dedc54afceb1c0d6a72b604c73aa050e85b43fbca9b23483c6a750ddccf1eafacdb6eeba209f2f094ef243e83fcc97e949e1328a09707ea5edc3a9b1a9419ee0eead816fc8e9923f2796339a35d1dec8057cdcb363265b813d319e647a154d0a61bc7b53c728c787d3be2acab4daba44ce8e25c53f64a2b8d7424aae5b3585a48a2979b15c3715cf9d7183587d0d0455e12a4a40161f859174cc50df557ff008246c5916291c0912c34745e8158f0c8c48d89c6a2bd96ee347049ad3504f7486a890dca32d555e1eac56aedba9fd23cebefe4d32b8cedc43a2811ef7ade902edd6c99cf8100b56980e4b7593c90dcced4d4237c9c1287707e07d03f40717b24b85a37d466122a03694d9615b1137e74bb1b12b276f9295e2652bcdd1d54e0e6b094c65d6b40f2f1c58203cd07a4ade3e3d2c2c7b11b29709e75a7f8fd499ea8483e26c4831a0a19b202a26f053a17a0a24b92c5c2abdbf8262b8175092661d60715909acd0c8e28a42dece7b93865a3665553b046cea17d1b730fd0c487ec0c71819f23229800da159efb986fe9f6ad9a9af7e5d8abdd03d4c77136e0ee3f54204c41102a5cc390a6a6f9bc507d37b2a6dd5bed361237c7392f6e7dc37d050d3469f6d3f9002baa981ce9b7fb5ae7d0d97287f9fe270abee041233b3f62e802abcfe8d461f153df028542b70bfe68e6a33fc033c397f7fa3d2e2cc93dcbdd9e1b8a0e98ce87683b5c75bd4c44fa123baebf1143df099b8aa091676be6a58c202e357fc7e980a0350a0e85152c0d0667cb68a24aa6ccd470209359374aa9697d524a3da03211fccba92754d2ec5132651347e4de58c2e4669b30223d591022d421cbad75433c198684a67f254843cdccc38b74aea36a1b73fb698721cadeb049d3aae38304a5397a78bd56f27969203220e331724426f8ddb16e0e9908e9ca5c6450cef4cacfbd42db9285f9a3289eb8010ed46bc6bd5f0ae239c56846e39fbe2d9a1bfe94650232543575522d0da15f027f6de39b11149af46b47d5f8a321956eb483c5bb07c54f8c39898d09ab93533f89fbb2faf91a8720cd28b5d88129dadd848dcf95ab6b6096614ad6c688fbc542e04b06a0d4c52564d7837f257aae1d2767e52559715445c52c989adc199b968058dc45dee03749a539973296a9e1c8278badbfe15f35cead8059ef948e7c05484750235bfcc1b647746ef645975b36090b9a23fd9a866a0ed46aca128599c15058abed5c11a5723636a285029f74072491b62dd02941fb92ac38881013d74a7af8a876578fa08ee05e1219b6c2a74f53942a60ab155907a55e8f9ec1812a1d52732d4c82ca943dd6819edfff348df8dd168ae012994ce2e5212e5a273b13217b3ebd2e5b4a3b9440e05668db7374f4bc82c01655abf595ef694569b03ef0c6569308603271fd3962b061a9082c02bb1af1bc198cf50d866a674029307c275b3042fe80fe51dbc8f288c6e749c0898f27c78e87366775879bb72811c383367ea257e85b761f5f009d733ddf0d144d5604030fd528fbf26511db35fa6d271f0ec348baec5c791b0d784c83bf1cee0fe314452dbf65fa2dd280cc975869bac6c84f28dfacd72a83cb3d3d708c1b1dc2d7cc25d4ee2a4ff65d5ec0e23c63789b632b67c22894f7bcbea8aabf4610a1767cd73ff5949cd412083b1f0171f53a34f6f87aa99d3cc003ac2bb7a0f19ff761a490dc8cab87ebe75eaeacc3b7bf19cd2e2083b8f4a7e0a3f043c22e5e75a6356fa8e9f9d8f7fbfe4c16cf312a2a3833a3904ebd17fbe1d6209d5d5762cba2a41d011245dafdd896729927d94c8cf29b7761a6bc9ce5713d5254d8af1728a9bd9d3748814cf3c229d48bfcef05200e33312b8e5d7a3958e686db4b8cb718ada6881b46f0da18e77fcf0d553d4bf6a433e1d063abbbce64befbb4a34155d566c9f3fbdca73f4c11fe702d4a0355704257f8e11d3f50816e4f76b5c000dbd160dca916a8150df751610072790739617a24e1e2ff773aaf2332c8190a241070151704e86c35c167d0caa57d6fcd4c03bf5b7693485b2909367f781961b60d7db425e35fad4d6f9694c6dc351b22617e778fcc40330ed3f8c43b7a2f6ab5b196cfe13913b2c2813d73227496388b7a812a7659b7b99aa1e66508c715acfcda877c7a06ceffec73b76a874c7be34080eded85758ec73530d978e4d5a9b16ea91e5b96cebd17e65870852bee42690fce6b29bbe13c6b23f75cd62f4677fcb371234f0be721e938f6c1d71472d5b1404a7a5f9741dd1f8ea1549e19ee9c22f05ceb2fd8ffcd6a42b9570f8ea7cb7394755d536c74f61398a322bae38f9d3e54d6bb8b2e50cd8d7b623ddeda422651898091a4ee9a8eb28eb541e4db9887ff2ffee90f0fb304d2bb944c2f005df2c94692853421f6a03aa0c3b74035ba980705e653700069363d4d7a9146185dfdf39341b47b255a69e7a1c356848412c003da18a536837690acca40a048b23a2b6b04430fa58eeb9f349c926862a04f0d293600370a6d3a5024aebbb017d6416b9bb616007107459df84a7d5b997651205c2f7b280b872d33fbe6285c570a2b90d2d4d55d9b671b38f78a1d48c559c7a6db6dfd6c170ae3c62b77aca7779bbed97272c5f3715485cf66fafe45034eeed652929d3d55585f44463a10e0b585ba9f73e722f301ab2dfb2766646450db5759af352a706d9dbfc1b326f5327986a4a3558593b8d4b1124a975e87f0d6dc82839538b6756d7b9794aaa905140cff2dfa7bed3c56e0408ea5e9d8ff721c6ef1d6f5da105a20f9d1516b882b65457da5ea3fcce5cf1148d875e2e6a59534e696ce0d4cdd9b08a9271cf5ebad4d25a1448458b9e288fe470cd430499366128936f99db69c0420b3a9344270d4ee44677acbdd7413abf3488a21901cde1e8545cebc4a085d6552a9b6924b92024894e35c2a99d4fdaecb7fcf48a3342068214e0f0ade7fa4117037c86b31e58bfc8537fb3f400d0b351c753de0312caadaa83a8f9417c9fa90835ea37213301a3497e4d4dd1a4be6eaf1600d5f7b6efa79fa11c8e31dbc1dfbb2e47ff545d9d6d6190b4234228676f00559fb9fd2ffb0d1de301d76860924b3099570fc2fe6d6e737d4180917afd9e8894148903845e88cc9563c4691996db3c572c1a9c9c275d2b965915e21b188327484a49edd5fe3161b11a2f3bd20ed42fa54529abbffae7f03f493cd994535515242b2d734b397fc6f65d340fdb28319e25af69bfec978971442746b6a89ed548f5c0ba73e85b06386b778c498f6adabc7c2b333f10a5d184d7513acd01d0e041a35572a104a35068029a91a1ccdcd9ca3b7b42c312eef8b09e31ae1aacff28ee209d9cedf5c873eb5e00e3a3b474ccc7c929618bb13b6526853d8e70602788ff7802e8ac6ca930af32917e9f239149de97d929f1034184ddbc83afbc58c06bfd3170821f48bb5add8023617d72d57042f904b321908f025a4c6d3ac622e15f9f5acc7fc2c8f0c83c60746cbc307fbd69df03ac75536f80f6495ca2acee238471393a3653d19edc13f321d3ab84ca03e6b99e06ca2d531a78e9077c278a325c3c93664c02ff27f801195f88ffa90111a2903a9e69de1175c4c814b8581c2bb17334455c52fb46a0029d4cabdb19226d59e199552bb36a5d6cab860dedad315c2865640d2882693eb282ac4adafb99fa100a9801c52d91339152182f5e1e29669dec7401ab87dd88b2001bc9c647251ba5205febdda92a8c9331e7251166914a7bd1ec1aaeefbbe626e91a38520845426225ac5bd298df3d90eac903a15f9de22602ad0658122b9c2d21b7f6543973f91853ef6ebddeaefa4508cde4f5ac217af8baf2d80d019c88b57baf8fc60da8d057ec4db061e6cb1374f3dc71e424555b4c0ec191a44abb763a6f318afb5011abf6694fd824d68d984c3520b46dcd61448d2fa9f81153ea046fb8b9d0f612310f2b3fc1837ef3ee695f454d4d39f2ccabaf77d006b9d28b7b8c8f067f51a99a64cb1445600c33432e2b800cba43699e282d6ef94376b6b738b003dc5d44352fc43bae80177bba0bc4eb04fe576feb4a6c4580dcbf49bb78e6e77034d7ef0e08287e43e024afc4b6b1c3d43c3dafeb543d260a8e36b9da0944df289c66654cf24ca35bea97d0103d1fa06e1a8c6fb18fcd9ccd72a743be3f6a856f26389fd0c275f922e5e17553158dda8ddec7a0ad1af6ea39200b0649d2520124d02616cb253fa5443cf745832293b2e6d60763932eef6238b239b2cf9ca01a8cccee7cc49abd397f2d4e5985f6c66f9909a246c7887985ef11c9a29308d49fb6e5880e732c6b52b8126901278e92d820a8cc45adac4131fff7290d08e72c68716ed6869fc55fab2b75f4e733d1f830d602646075782317a477b0b588214e7ca34873edeabfc6b4aa3d851dd7ac3bd9e08ac3baa2b419012bfeef11defac0713448107b8793e2a9779f3e92398de6a6e42b7b29434fb16dfa19bb51663d85eb3758fc91fb1648f4c12d275b29319172a76e6d1c9ab1fd9421cb35cd6283bdcdc299e6bb48cf04c3aacabb1ab9bbf7d4511b393923f2a40a1f3203bc9479f8620fad107dca0378957ac84b2a217364ae5f63c324d61ab5147d7af4958053abd198982327b2ff6ae9523b882f5c176745ef2b7ddc5dfe25ad208bd297e77e7481b486cbe704887a676e65a599e2598fa6dc08b38fdf38b15da539a9042b0e3a22ee8739f57364e3f990d7d40624bce07e30253114b685a0ff4b8b4326cdd946ef2b4ec0c937ebee4f8fc90ad1b481b5212d7281cdc71265e9f3d4e02873f44f94b80933ef0140f1b3922262490c45464105b62a6030188b3387380dc60502d321dd5a90f61c545af25ede5956ec18f6c80943b285664276688de3b77d0e0fad215f1e905332f3369b1902cf5a32ddd33ce49b5b635b4f7f7cbce5a202bf94718cb58d387bfa81a5e866d7e529b192ae8a825edb78b0feef53037f16d7e234647efa6a91325dfc18f84c795827e8592757bc1664edc3e846e18c5739e8c83a2b942f2726736c7c28480abad2ab56bf1aeedc5002b4e3e34a4cd8f2482c5fb48b5d3269cbf95ac4e0314d34071695dffacadd1ecff32238581023afb7ae844b3f9ce347316fb6d7deb09a92cd20cd26d3ea88be03b8399a7f99462c74658c3a08979fba924d9ce6bda6d16a85ca87cc2da103e99cb09d763ad17f061fb4f525074558bd05e3d75973e74ad281f38b47f561a39bbb4fa5be75e1911cbcec08990a8c1bd4e1bc378eccdeb5b3694eb02766817827bfde3b9f2989422fccc86e8a877499e597a76813ce70a788da5965aff7dd57e102fd332f1c1dbabaf10a96832d652ece2783a2d8236d07256c83eff242ade303a3c6c0e3c0f9e2e0a5a8ddb8caaa95dd0aecb58b69a033d060b1bde6ea07a853338233aca55ea4c2a7523ef243825b7340ccc7446e6b08e98951b9ced161803f66232f7d35c50b8389c30acef951f79c9e8f077042eeb34d1bdc4bee52780425986ca100efec3a1bce30264aad1bd84520ee18b55f24f87da4249d10198c3fb8c11447db341c2ff2bb2ba85346cebcf63452333ad57d0d691301ee6c7a9e8a523f46f26716625bb5a53e8b55bca7ec7ab01c73254020e94d49379c4942ece3dc6d6f94df3b73fdccb1b78dc5d34435abcc7a17e831596006e3bcebee63acecf8a11c9da2bebd67bd5f5bd383a38e2490244c9a2a9bbbb201ccb20816a85d249d7ac5af444cc97b2bb53d90272ee0eb0ac27451263827e72797f60b2c82f6ee3e6e9673cca8a3b68a537731ddb464f856eeb33c3bb49401ff012e56bef8e7d05000fb7fccb6b5f00fea314172974dfbdabf7f417c6b733e3d9b6a11449a094ea2f84889b3eac61080c4b1bb7f8853ff3be0f466e876229912cb7bd130c0a573de73b9ad5db3e468953e0d289a71b930ba9a4e0462babaf82acf17b72e4beafe3f1dc623425a0a5fa85bba37f9057b784adf234358a3f8b12d3f4b9be455cf4b46fb915f7a290856ecb406d4fd0fee7ba8bbf72b792287fb9a8ce9d089caa83a5c71ade5949f79f1999798365e6ebe9f8b0bd243991cb34708336c87d6ac3a6dfefdb29475e62cf3aced41ff609dd431420668168e8b6cf00dc519c1796172134b802e7ba9512cef65fc1dc99511f0d082774b22f3b259b79ac2f0db552fca0dbd0c1497a968d632343364848318bb374408719b2d2f97d9d50510a4d2a03674a9bdaf098e20f03c2c088c39659156e914043fec81dafd8854f0c16260981c62253a5a4e67fb35e29c5d9ac916dea1123a77604fdcc7ffe04ebe03775ea8863b63f6d560c18814d074901f1c9457e0e7cab59f2a3a152570469cf7d78a2fe15d7515495c63579dd6cfbb63597a76d0ca13274911e475f1605d079b9a4baadd70a9e20c0d99ab7ba3061370b53fd8653b34f3aaa8b4a28bc4aa280882e72c218e0448593ce7b2136950ddb26bca7eaf3b8287ff038809d1500d13876e8643813cb3ccc0ccdd87af767903fce52da8ea3e79f9654210717add11f2ba0ec62d9f4226d1a9743c6f440cd31f6dc1f5a24a8e7360aa718be0e39fd8c9097d946842ccea6f45da4c91c3d378cee563217b07bc06a712bf297a76d8d1bbe099ee79de608586bbfd45e9397f32e178f3bdc336a7cf2d8c9dbe1b6afa2981f1e9faaf2720446c6a3b4149eb52eb4c007057a91282573b3f48b4447a47127016682dfdc1e976027bb07c97bff85e4e2a4dff8737e4efec63aad8823e54321bb2a81850024748edc5feb1fa224a1bde36235086c0b57438b0497e375124141e24f99fa5416e30d59362164bb5f3b769b22a1c874bc7f2d69cec546874b40ae81c802731682e798e4831a36554a10f260235e0c8faa93b0a529e0ddc19e75d872a64581d59667449e86747ce3bfaf0fe574644e4d49e4fe4da12a3e1dafe37eb8703097d242dde2d01d9f2769abd74d220b2b245cb141547ab404cb86cbcc465d1d3bae41173271116ecc2aae36fba0ebe57cade6b5d25293b3bbf8fd6d5f0a9dcf7c8742d8dd3d04e1d98dbcf6ee12dd3a972b32b547984083e5be704cbdaa8165e1d9f4097f74024aa0a20b09a8520c396265c8e5f8ab96476c78b97fe7da2b26e9621cbc79edb65779929e1fba6f8491801bf7eec710871e5ac062