CVE-2024-52006
Newline confusion in credential helpers can lead to credential exfiltration in git
Description
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.
INFO
Published Date :
Jan. 14, 2025, 7:15 p.m.
Last Modified :
Dec. 18, 2025, 4:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | LOW | [email protected] |
Solution
- Update Git to version 2.48.1 or later.
- Avoid cloning from untrusted URLs if upgrade is not possible.
Public PoC/Exploit Available at Github
CVE-2024-52006 has a 5 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-52006.
| URL | Resource |
|---|---|
| https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g | Not Applicable |
| https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060 | Patch |
| https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q | Not Applicable |
| https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp | Patch Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html | Mailing List Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-52006 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-52006
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
It is an Demo 1st time I do an code in GitHub.
None
None
HTML
None
HTML
None
HTML CSS
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-52006 vulnerability anywhere in the article.
-
tripwire.com
VERT Threat Alert: February 2025 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s February 2025 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1143 as soon as coverage is completed.I ... Read more
-
The Hacker News
GitHub Desktop Vulnerability Risks Credential Leaks via Malicious Remote URLs
Vulnerability / Software Security Multiple security vulnerabilities have been disclosed in GitHub Desktop as well as other Git-related projects that, if successfully exploited, could permit an attacke ... Read more
The following table lists the changes that have been made to the
CVE-2024-52006 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Dec. 18, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions up to (excluding) 2.40.4 *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions from (including) 2.41.0 up to (excluding) 2.41.3 *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions from (including) 2.42.0 up to (excluding) 2.42.4 *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions from (including) 2.43.0 up to (excluding) 2.43.6 *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions from (including) 2.44.3 up to (excluding) 2.44.3 *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions from (including) 2.45.3 up to (excluding) 2.45.3 *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions from (including) 2.46.3 up to (excluding) 2.46.3 *cpe:2.3:a:git:git:*:*:*:*:*:*:*:* versions from (including) 2.47.0 up to (excluding) 2.47.2 *cpe:2.3:a:git:git:2.48.0:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Added Reference Type GitHub, Inc.: https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q Types: Not Applicable Added Reference Type GitHub, Inc.: https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp Types: Patch, Vendor Advisory Added Reference Type GitHub, Inc.: https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g Types: Not Applicable Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html Types: Mailing List, Third Party Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 03, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html -
CVE Modified by [email protected]
Jan. 21, 2025
Action Type Old Value New Value Changed Description Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. -
New CVE Received by [email protected]
Jan. 14, 2025
Action Type Old Value New Value Added Description Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-116 Added CWE CWE-147 Added CWE CWE-150 Added Reference https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060 Added Reference https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q Added Reference https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp Added Reference https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g