Penetration Test Report (X41 D-Sec): X41 OSTIF Gitlab Git Security Audit 20230117 public

SourceCodeAuditonGit
forOpenSourceTechnologyImprovementFund(OSTIF)
FinalReport(git-security)
2023-01-17
PUBLIC
X41 D-SEC GmbH
Krefelderstr. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
IncooperationwithGitLabInc.
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
Revision Date Change Author(s)
1 2022-12-09 Private Report (git- E. Sesterhenn, J. Schneeweisz,
security) M.Vervier
2 2023-01-17 PublicReport E. Sesterhenn, J. Schneeweisz,
M.Vervier
X41D-SecGmbH PUBLIC Page1of95
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 Summary 4
2 Introduction 7
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3 RatingMethodologyforSecurityVulnerabilities 13
3.1 CommonWeaknessEnumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4 Results 15
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5 AboutX41D-SecGmbH 86
A Fuzzing 88
X41D-SecGmbH PUBLIC Page2of95
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name Git
Type SourceCode
Version 2.38.1
Engagement
Type SourceCodeReview
Consultants 3:EricSesterhenn,JoernSchneeweisz,andMarkusVervier
41 person days, 29 sponsored by OSTIF, 12 by GitLab,
EngagementEffort
2022-11-01to2022-12-09
Totalissuesfound 8
Critical - 2
High - 1 CWE-1333(1)
CWE-400(2)
CWE-1088(1)
Medium - 1
CWE-680(1)
Low - 4 CWE-122(2)
CWE-125(1)
None - 27
0 2 4 6 8 10 12 14 16 18 20 22 24 26
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of95
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
1 Summary
In November and December 2022, X41 D-Sec GmbH performed a security source code audit
againsttheGittoidentifysecurityissues.ThetestwasorganizedbytheOpenSourceTechnology
-ImprovementFund1 asaconcertedeffortinvolvingmultipleteams. GitLab2 directlysupported
theassessmentbysponsoringparticipationoftheGitLabSecurityResearchTeam3 intheaudit.
Atotalofeightvulnerabilitieswerediscoveredduringthetestbytheteam. Twowereratedas
critical, one was classified as high severity, one as medium, and four as low. Additionally, 27
issueswithoutadirectsecurityimpactwereidentified.
Medium - 1
High - 1
Low - 4
Critical - 2
Figure1.1:IssuesandSeverity
1https://ostif.org
2https://about.gitlab.com
3https://about.gitlab.com/handbook/security/threat-management/security-research/
X41D-SecGmbH PUBLIC Page4of95
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
Gitisadistributedversioncontrolsystemthatallowsdeveloperstocollaborateonsoftwarede-
velopment.Itisintegratedintopopularpackagingsystems,includingGolangmodules,Rustcargo,
andNodeJSNPM.AvulnerabilityinGitcouldpotentiallyallowattackerstocompromisesource
coderepositoriesordevelopersystems. Inahypotheticalscenario, awormablevulnerabilityin
Gitcouldresultinsecuritybreachesonalargescale.
ThesourcecodeofGitwasinspectedforvulnerabilitiesbysecurityexpertsEricSesterhenn(X41),
JoernSchneeweisz(GitLab),andMarkusVervier(X41)usingmanualcodereview,codeanalysis
tools,andcustomfuzzingefforts.
Thereviewtookplacebetween2022-11-01and2022-12-09.
Themostsevereissuediscoveredallowsanattackertotriggeraheap-basedmemorycorruption
during clone or pull operations, which might result in code execution. Another critical issue al-
lows code execution during an archive operation, which is commonly performed by Git forges.
Additionally,ahugenumberofintegerrelatedissueswasidentifiedwhichmayleadtodenial-of-
servicesituations,out-of-boundreadsorsimplybadlyhandledcornercasesonlargeinput.
On a positive note, the use of many short-running processes reduces the impact of memory
disclosure issues and allows for an error-handling where the operating system performs most
cleanups. This greatly reduces the amount of anti-patterns for common issues usually found
in C programs such as use-after-free issues. Additionally, the use of a stringbuffer wrapper to
performstringoperationsandthatfunctionsoftenleadingtosecurityerrorsaredisallowed(such
asstrcpy())hasapositiveeffectontheoverallsecurity.
Onanotherpositivenote,itwasvisiblethatthesoftwarehasbeensubjecttoimprovementsthat
protectagainstlogicalerrorswhenitcomestoprocessinguntrustworthycontentsfromremote
repositories.
GiventhesizeoftheGitcodebase,findingeachpotentialinstanceofmemorysafetyissueswould
beasignificantundertaking, notpossibleinthetimegivenforthisreview. Toaddressthis, we
recommendextendingtheuseofsafewrappersanddevelopingstrategiestomitigatecommon
memorysafetyissues.Introducinggenerichardeningssuchassanitychecksondatainputlength
and the use of safe wrappers can improve the security of the software in the short term. The
usageofsignedintegertypedvariablestostorelengthvaluesshouldbebanned.Additionally,the
softwarecouldbenefitfromcompilerlevelchecksregardingtheuseofintegerandlongvariable
typesforlengthandsizevalues.Enablingtherelatedcompilerwarningsduringthebuildprocess
canhelpidentifytheissuesearlyinthedevelopmentprocess.Finally,improvingthecustomerror
handlingcanenablebetteranalysisofthecodewithtoolslikeValgrindormemoryleakcheckers.
Inconclusion,theGitcodebaseshowsseveralsecurityissuesandthesheersizeofthecodebase
makes it challenging to address all potential instances of these issues. The use of safe wrap-
pers can improve the overall security of the software as a short term strategy. As a long term
X41D-SecGmbH PUBLIC Page5of95
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
improvementstrategy,werecommendtoalternatebetweentime-boxedcodebaserefactoring
sprintsandsubsequentsecurityreviews.
X41D-SecGmbH PUBLIC Page6of95
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
X41 reviewed the source code of the Gitfreeandopensourcedistributedversioncontrolsystem.
It allows developers to share source code and track changes made by others and designed to
handleeverythingfromsmalltoverylargeprojectswithspeedandefficiency.
Git is a commonly used version control system in the software industry, and is integrated into
varioussoftwareecosystemssuchasGolang,Rust,andNodeJS/NPM.Asaresult,securityvulner-
abilitiesinGitcanhavefar-reachingeffectsonindividualsandorganizations. Toprotectagainst
thesepotentialrisks,itisessentialtoaddressandfixanyexploitablesecurityissuesinGit.
Beingexposedbydesigntountrustworthydata, attackerscouldtrytoattackrepositoriesboth
upstream and downstream by uploading malicious data, attacking the Git protocol, or exploit
issues in the interaction with transport protocols such as HTTP1 or SSH2. Logic issues might
beexploitedwhichcouldallowtamperingwiththeintegrityofrepositoriesortogainaccessto
protectedrepositories.
GiventhenatureofGitandit’sintegrationintodevelopmentandsoftwaredistributionprocesses,
codeexecutionvulnerabilitiescouldevenbecomewormable.
2.1 Methodology
AmanualapproachforpenetrationtestingandforcodereviewisusedbyX41. Thisprocessis
supportedbytoolssuchasstaticcodeanalyzersandindustrystandardwebapplicationsecurity
tools3. Thereviewprocessisperformedinthefollowingsteps:
1. Identifythescopeofthereview:Weworkcloselywithourclientstounderstandtheirgoals
andobjectivesforthesourcecodesecurityreview. Thishelpsusdefinethescopeofthe
1HyperTextTransferProtocol
2SecureShell
3https://portswigger.net/burp
X41D-SecGmbH PUBLIC Page7of95
SourceCodeAuditonGit OpenSourceTechnologyImprovementFund(OSTIF)
reviewandensur