VIR Vulnerability Intelligence Relay

CVE-2017-1000117

high
Published 2017-10-05 · Modified 2026-05-13
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
8.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
9.8

Description

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-42599 remote python verified
Metasploit · 2017-08-31

Git < 2.7.5 - Command Injection (Metasploit)

Source code queued for fetch — refresh in a moment.

Metasploit modules

exploit_multi/http/git_submodule_command_exec rank 600
Malicious Git HTTP Server For CVE-2017-1000117
Source fetch failed: fetch_error — view the original via the link above.

OS impact
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —
arch Arch Fixed 1 release
VersionStatusFixed in
— Fixed 2.14.1-1
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 1:2.14.1-1
sid Fixed 1:2.14.1-1
forky Fixed 1:2.14.1-1
bullseye Fixed 1:2.14.1-1
bookworm Fixed 1:2.14.1-1

Application impact
VendorProductVersionsFixed
git-scmgit{"endIncluding":"2.7.5"}
git-scmgit2.8.0
git-scmgit2.8.1
git-scmgit2.8.2
git-scmgit2.8.3
git-scmgit2.8.4
git-scmgit2.8.5
git-scmgit2.9.0
git-scmgit2.9.1
git-scmgit2.9.2
git-scmgit2.9.3
git-scmgit2.9.4
git-scmgit2.10.0
git-scmgit2.10.1
git-scmgit2.10.2
git-scmgit2.10.3
git-scmgit2.11.0
git-scmgit2.11.1
git-scmgit2.11.2
git-scmgit2.12.0
git-scmgit2.12.1
git-scmgit2.12.2
git-scmgit2.12.3
git-scmgit2.13.0
git-scmgit2.13.1
git-scmgit2.13.2
git-scmgit2.13.3
git-scmgit2.13.4
git-scmgit2.14.0

References

CWEs

CWE-601

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.