{"id":15756,"date":"2025-04-01T20:44:26","date_gmt":"2025-04-01T20:44:26","guid":{"rendered":""},"modified":"2025-06-14T07:02:36","modified_gmt":"2025-06-14T13:02:36","slug":"cve-2023-49569-critical-path-traversal-vulnerability-in-go-git-leading-to-potential-remote-code-execution","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-49569-critical-path-traversal-vulnerability-in-go-git-leading-to-potential-remote-code-execution\/","title":{"rendered":"CVE-2023-49569: Critical Path Traversal Vulnerability in go-git Leading to Potential Remote Code Execution"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

CVE-2023-49569 is a critical path traversal vulnerability discovered in go-git, a pure Go implementation of Git. This vulnerability allows attackers to create or modify files across the filesystem, potentially leading to remote code execution (RCE) in applications using go-git under specific configurations.\u200b<\/p>\n\n\n\n

The issue arises when applications utilize the ChrootOS<\/code> filesystem, which is the default when using “Plain” versions of the Open<\/code> and Clone<\/code> functions (e.g., PlainClone<\/code>). Applications using BoundOS<\/code> or in-memory filesystems are not affected. Notably, this vulnerability does not impact<\/a> the upstream Git CLI.\u200b<\/p>\n\n\n\n

Vulnerability Summary<\/h2>\n\n\n\n
Field<\/th>Detail<\/th><\/tr><\/thead>
CVE ID<\/strong><\/td>CVE-2023-49569<\/td><\/tr>
Severity<\/strong><\/td>Critical (CVSS v3.1 Score: 9.8)<\/td><\/tr>
Attack Vector<\/strong><\/td>Network<\/td><\/tr>
Privileges Required<\/strong><\/td>None<\/td><\/tr>
User Interaction<\/strong><\/td>None<\/td><\/tr>
Impact<\/strong><\/td>Remote Code Execution<\/a><\/td><\/tr>
Affected Component<\/strong><\/td>go-git (ChrootOS filesystem)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

Affected Products<\/h2>\n\n\n\n
Product<\/th>Affected Versions<\/th><\/tr><\/thead>
go-git<\/td>v4.0.0 to v5.10.x<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Applications using go-git with the default ChrootOS<\/code> filesystem are susceptible. Those using BoundOS<\/code> or in-memory filesystems are not affected.\u200b<\/p>\n\n\n\n

How the Exploit Works<\/h2>\n\n\n\n

The vulnerability stems from improper sanitization<\/a> of file paths in go-git’s ChrootOS<\/code> filesystem. An attacker can craft malicious Git server responses containing path traversal<\/a> sequences (e.g., ..\/<\/code>) to write files outside the intended directory.\u200b<\/p>\n\n\n\n

In the worst-case scenario, this could allow an attacker to overwrite critical system files or place malicious executables, leading to remote code execution<\/a> when these files are executed by the system or application.\u200b<\/p>\n\n\n\n

Conceptual Exploit Example<\/h2>\n\n\n\n

An attacker sets up a malicious Git server that, during a clone operation, responds with crafted paths designed to traverse<\/a> directories.\u200b<\/p>\n\n\n\n

For instance, a malicious .git<\/code> repository could contain a file with a path<\/a> like:\u200b<\/p>\n\n\n\n

bashCopyEdit\n..\/..\/..\/..\/..\/..\/etc\/cron.d\/malicious_job\n<\/code><\/pre>\n\n\n\n
When an application using go-git with ChrootOS<\/code> clones this repository, it writes the file<\/a> to \/etc\/cron.d\/malicious_job<\/code>, potentially scheduling a malicious cron job.\u200b<\/p>\n\n\n\n
Recommendations for Mitigation<\/h2>\n\n\n\n
To mitigate the risks associated with CVE-2023-49569:<\/p>\n\n\n\n