Summary
GitPython fails to properly validate newline characters in the section parameter of config_writer(), enabling injection of arbitrary section headers into .git/config.
Under conditions where an attacker can influence config_writer() input, this can be abused to forge a [core] hooksPath pointing to attacker-controlled directories, leading to remote code execution when git hooks run.
Affected context
This vulnerability affects applications or tooling that embed GitPython (before 3.1.50) and invoke config_writer() to manipulate repository configuration.
It is most relevant when user-supplied or otherwise untrusted values are passed as the section name, and when the resulting .git/config is later consumed by a git client that honors hooksPath.
Environments where git hooks are enabled and can be triggered (for example, during commits, pushes, or other lifecycle actions) are particularly exposed.
Exploit preconditions
- Attack surface: Any interface that allows an attacker to control or influence the section parameter of GitPython's config_writer().
- Required access: Ability to supply or tamper with configuration values used by config_writer(), typically via application inputs, APIs, or plugin systems.
- Trigger point: A crafted section value containing newline characters is written into .git/config, resulting in injected section headers and a forged core.hooksPath pointing to attacker-controlled content.
- Why exploitation is possible: The library does not sanitize or reject newline characters in the section field, permitting config injection and redirection of git hooks to arbitrary directories.
Why this happens
The underlying issue is improper input validation in GitPython's configuration writing logic.
The section parameter, which should represent a single well-formed configuration section name, is not checked for control characters such as newlines.
This allows attackers to break out of the intended section context and inject additional, unintended sections into .git/config, including a spoofed [core] section with a malicious hooksPath.
Conceptually, this aligns with CWE-20: Improper Input Validation, where failure to constrain and sanitize inputs permits structural manipulation of configuration data and redirection of execution to attacker-controlled locations.
Potential impact
- Remote code execution via malicious git hooks located in attacker-controlled directories.
- Execution of arbitrary scripts during common git workflows (e.g., commit, push, merge) on developer or CI/CD machines.
- Compromise of developer workstations, build agents, or automation systems that use GitPython to manage git configuration.
- Introduction of backdoors or supply-chain attacks by tampering with repositories and build outputs.
General mitigation guidance
Effective mitigation focuses on constraining configuration input and minimizing trust in dynamic configuration sources.
Recommended defensive patterns include:
- Enforcing strict validation on section names passed to config_writer(), rejecting or escaping newline and other control characters.
- Restricting the origin of configuration values so that only trusted, predefined section identifiers are used when writing .git/config.
- Decoupling user-controllable inputs from low-level git configuration, introducing mapping layers or whitelists for allowable section names and paths.
- Operating with least privilege by limiting the availability and use of git hooks in high-risk environments such as CI/CD infrastructure.
- Applying defense-in-depth by treating git configuration as sensitive and reviewing any automation that programmatically modifies .git/config.
How teams detect issues like this
Detection can target both code-level patterns and runtime configuration anomalies.
Possible approaches include:
- Static analysis rules that flag calls to GitPython's config_writer() where the section argument is derived from user input or unconstrained variables.
- Code review checklists that require validation of all configuration section names and paths, with special scrutiny on .git/config writers.
- Automated scanning of repositories or workspaces for suspicious .git/config entries, such as unexpected [core] sections or hooksPath values pointing outside approved directories.
- Security policies in CI/CD pipelines that monitor for or block unapproved git hooks directories and enforce standardized configuration templates.
Automated code review tools and configuration linters can help surface misuse of configuration writers before deployments.
