MediumSupply chainBLWK-DEV-002

Git trusts repositories owned by anyone (‹path›)

What this means

‹path› sets safe.directory = *, which turns off Git's protection against repositories owned by another user (CVE-2022-24765). A repository someone else controls — on a shared machine, in /tmp or a mounted drive — can then set core.fsmonitor or a hook that runs a command as you the moment you, your shell prompt or your editor runs git status there.

How to fix it

Replace the wildcard with the specific directories you need: git config --global --unset-all safe.directory, then git config --global --add safe.directory /path/to/that/repo for each one.

Check it yourself

Run a scan and look for BLWK-DEV-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind == "git" and safe_directory_any == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1059
• MITRE ATT&CK T1204

Related checks

• Git skips TLS certificate checks (‹path›) · BLWK-DEV-001
• Git allows the ext:: transport, which runs commands from a URL (‹path›) · BLWK-DEV-003
• SSH doesn't check server identities (‹path›) · BLWK-DEV-004
• SSH forwards your agent to every server (‹path›) · BLWK-DEV-005
• npm/yarn installs packages without checking TLS certificates (‹path›) · BLWK-DEV-006
• Packages are installed from a plain-HTTP registry (‹path›) · BLWK-DEV-007