HighSupply chainBLWK-DEV-003

Git allows the ext:: transport, which runs commands from a URL (‹path›)

What this means

‹path› sets protocol.allow (or protocol.ext.allow) to always. An ext:: remote is a shell command, so a submodule URL or a link in a project can run arbitrary code on this machine when Git fetches it. Git disables it by default for exactly this reason.

How to fix it

Remove the setting: git config --global --unset protocol.allow and git config --global --unset protocol.ext.allow. If one tool needs ext::, pass -c protocol.ext.allow=always on that one command.

Check it yourself

Run a scan and look for BLWK-DEV-003 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads dev_tool_config and reports this check when:

kind == "git" and ext_protocol_allowed == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1059
• MITRE ATT&CK T1195.001

Related checks

• Git skips TLS certificate checks (‹path›) · BLWK-DEV-001
• Git trusts repositories owned by anyone (‹path›) · BLWK-DEV-002
• SSH doesn't check server identities (‹path›) · BLWK-DEV-004
• SSH forwards your agent to every server (‹path›) · BLWK-DEV-005
• npm/yarn installs packages without checking TLS certificates (‹path›) · BLWK-DEV-006
• Packages are installed from a plain-HTTP registry (‹path›) · BLWK-DEV-007