Impact

Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience are users who are uncomfortable with using Git on the command-line.

Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called aspell.exe if it was found.

Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. Therefore, malicious repositories can ship with an aspell.exe in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code.

Patches

• 91b0797, also submitted as prati0100/git-gui#85

Workarounds

Avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources.

References

• Tcl's exec function documentation
• prati0100/git-gui#85

For more information

If you have any questions or comments about this advisory:

• Open a discussion/issue in https://github.com/git-for-windows/git (or if there is already a related discussion/issue, comment on that).
• For security concerns, email us on the Git security mailing list