CVE-2023-41040: GitPython blind local file inclusion

Vulnerability summary

CVE-2023-41040 is a medium (CVSS 6.5) vulnerability in gitpython_project gitpython. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-08-2023
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.