HighSupply chainBLWK-DEV-001

Git skips TLS certificate checks (‹path›)

What this means

‹path› sets http.sslVerify = false for every remote. Anyone on the network path — public Wi-Fi, a compromised router or proxy — can impersonate GitHub or your Git server, read the credentials Git sends, and hand you modified code that you then build and run.

How to fix it

Remove the line with git config --global --unset http.sslVerify. If one server has a private certificate, trust its CA for that server only: git config --global http.https://git.example.com/.sslCAInfo /path/to/ca.pem

Check it yourself

Run a scan and look for BLWK-DEV-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind == "git" and ssl_verify_off == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1557
• MITRE ATT&CK T1195.001

Related checks

• Git trusts repositories owned by anyone (‹path›) · BLWK-DEV-002
• Git allows the ext:: transport, which runs commands from a URL (‹path›) · BLWK-DEV-003
• SSH doesn't check server identities (‹path›) · BLWK-DEV-004
• SSH forwards your agent to every server (‹path›) · BLWK-DEV-005
• npm/yarn installs packages without checking TLS certificates (‹path›) · BLWK-DEV-006
• Packages are installed from a plain-HTTP registry (‹path›) · BLWK-DEV-007