CVE-2017-17831

Published: Dec 21, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.

Affected (1)

Products: Git Large File Storage Project: Git Large File Storage

Git Large File Storage Project

1 product

Git Large File Storage

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Git Large File Storage Project Git Large File Storage	Before 2.1.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://blog.recurity-labs.com/2017-08-10/scm-vulns

Source: cve@mitre.org

ExploitThird Party Advisory

http://www.securityfocus.com/bid/102926

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/git-lfs/git-lfs/pull/2242

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1

Source: cve@mitre.org

Release NotesThird Party Advisory

http://blog.recurity-labs.com/2017-08-10/scm-vulns