Summary
A path traversal vulnerability in Dulwich on Windows allows malicious Git repositories to use DOS drive-letter prefixes to bypass path validation during checkout. If an attacker can cause a repository to be cloned or checked out, crafted tree entries may write files outside the intended worktree and potentially enable remote code execution.
A path traversal vulnerability in Dulwich on Windows allows malicious Git repositories to use DOS drive-letter prefixes to bypass path validation during checkout. If an attacker can cause a repository to be cloned or checked out, crafted tree entries may write files outside the intended worktree and potentially enable remote code execution.
Affected context
This issue affects Dulwich deployments before version 1.2.9 when repositories are checked out on Windows systems. It becomes risky when untrusted or attacker-controlled repositories are processed and Git tree path elements are not correctly validated for Windows drive-letter semantics. The vulnerable behavior may allow a path such as a DOS drive-letter prefix to escape the intended worktree boundary.
This issue affects Dulwich deployments before version 1.2.9 when repositories are checked out on Windows systems. It becomes risky when untrusted or attacker-controlled repositories are processed and Git tree path elements are not correctly validated for Windows drive-letter semantics. The vulnerable behavior may allow a path such as a DOS drive-letter prefix to escape the intended worktree boundary.
Exploit preconditions
- Attack surface: Repository clone, checkout, or other operations that materialize Git tree entries on Windows
- Required access: Ability to provide or cause processing of a malicious Git repository
- Trigger point: Conversion of Git tree paths into filesystem paths during checkout
- Why exploitation is possible: Insufficient validation of DOS drive-letter prefixes can allow a tree entry to resolve outside the designated worktree
- Attack surface: Repository clone, checkout, or other operations that materialize Git tree entries on Windows
- Required access: Ability to provide or cause processing of a malicious Git repository
- Trigger point: Conversion of Git tree paths into filesystem paths during checkout
- Why exploitation is possible: Insufficient validation of DOS drive-letter prefixes can allow a tree entry to resolve outside the designated worktree
Why this happens
The underlying bug is incomplete filesystem path validation for Windows-specific path syntax.
Git tree entries are treated as relative paths, but a DOS drive-letter prefix can change how the Windows filesystem interprets the resulting path. When that prefix is not rejected or safely normalized before file creation, attacker-controlled repository data can escape the intended directory boundary. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
The underlying bug is incomplete filesystem path validation for Windows-specific path syntax.
Git tree entries are treated as relative paths, but a DOS drive-letter prefix can change how the Windows filesystem interprets the resulting path. When that prefix is not rejected or safely normalized before file creation, attacker-controlled repository data can escape the intended directory boundary. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- Arbitrary files may be written outside the intended worktree
- Existing files could be overwritten or modified
- Application configuration or startup files may be tampered with
- Code execution may occur when affected files are later loaded or executed
- Repository-processing systems could be compromised
- Arbitrary files may be written outside the intended worktree
- Existing files could be overwritten or modified
- Application configuration or startup files may be tampered with
- Code execution may occur when affected files are later loaded or executed
- Repository-processing systems could be compromised
General mitigation guidance
Mitigation generally focuses on enforcing a strict worktree containment boundary for every extracted path.
Common defensive patterns include:
- Rejecting absolute paths, DOS drive-letter prefixes, and other platform-specific escape forms
- Canonicalizing and validating paths before file creation or replacement
- Verifying that resolved destinations remain beneath the intended worktree
- Treating repositories from untrusted sources as untrusted input
- Running repository processing with least-privilege filesystem permissions
- Isolating checkout operations from sensitive files and execution-capable locations
- Applying secure-by-default archive and repository extraction policies
Mitigation generally focuses on enforcing a strict worktree containment boundary for every extracted path.
Common defensive patterns include:
- Rejecting absolute paths, DOS drive-letter prefixes, and other platform-specific escape forms
- Canonicalizing and validating paths before file creation or replacement
- Verifying that resolved destinations remain beneath the intended worktree
- Treating repositories from untrusted sources as untrusted input
- Running repository processing with least-privilege filesystem permissions
- Isolating checkout operations from sensitive files and execution-capable locations
- Applying secure-by-default archive and repository extraction policies
How teams detect issues like this
Organizations can detect related risks through:
- Static analysis rules for path joins followed by file writes without containment checks
- Code review checks for platform-specific path normalization and drive-letter handling
- Tests covering absolute paths, parent-directory traversal, alternate separators, UNC paths, and DOS drive prefixes
- Policy enforcement that restricts untrusted repository processing on Windows hosts
- Runtime monitoring for checkout processes writing outside approved worktree directories
Automated security review tools may help identify incomplete path validation, but platform-specific tests remain important.
Organizations can detect related risks through:
- Static analysis rules for path joins followed by file writes without containment checks
- Code review checks for platform-specific path normalization and drive-letter handling
- Tests covering absolute paths, parent-directory traversal, alternate separators, UNC paths, and DOS drive prefixes
- Policy enforcement that restricts untrusted repository processing on Windows hosts
- Runtime monitoring for checkout processes writing outside approved worktree directories
Automated security review tools may help identify incomplete path validation, but platform-specific tests remain important.
