CVE-2018-17456
CRITICALEPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Description
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Git Submodule - Arbitrary Code Execution
by joernchen · Oct 16, 2018
Git Submodule - Arbitrary Code Execution (PoC)
by Junio C Hamano · Oct 5, 2018
Frequently Asked Questions
Is CVE-2018-17456 in your stack?
O3 detects CVE-2018-17456 across dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.