Command Injection in libgit2 via libssh2 Backend

libgit2 versions v0.27.0 through v1.9.0 are vulnerable to command injection when compiled with the libssh2 SSH backend (USE_SSH=libssh2). The flaw resides in the gen_proto() function within ssh_libssh2.c, which fails to sanitize repository path inputs before concatenating them into shell command strings. This vulnerability allows an attacker to achieve remote code execution by forcing a user or system to perform a recursive git clone of a repository containing a maliciously crafted .gitmodules file. When the client processes the submodule URL, the injected shell metacharacters - such as single quotes, semicolons, or pipes - are interpreted by the remote server's shell. This execution occurs with the privileges of the user running the git operation, posing a significant risk to CI/CD pipelines, developer workstations, and automated server environments that rely on libgit2 for repository management.

Impact

Successful exploitation allows remote attackers to execute arbitrary shell commands under the context of the user or service account performing a git clone operation. This impacts any software, CI/CD pipeline, or automated system utilizing affected libgit2 versions, potentially leading to full system compromise, exfiltration of credentials stored in SSH agents, or lateral movement within build environments.

Recommendation

• Update all instances of libgit2 to version 1.9.1 or later to resolve the underlying vulnerability in the gen_proto() function.
• Audit build environments and CI/CD configurations to identify applications linked against the libssh2 SSH backend of libgit2.
• Monitor git operations for unexpected recursive submodule processing, particularly those targeting unknown or untrusted external repositories.
• Implement strict path validation and utilize SSH configurations that restrict command execution for services performing automated clones.