{"vulnerability": "cve-2023-2900", "sightings": [{"uuid": "eab709f7-3999-41fd-9e9b-007450162235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29001", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113556357978279669", "content": "", "creation_timestamp": "2024-11-27T18:35:13.557290Z"}, {"uuid": "ae80ac02-7162-4f8c-881f-fb912ada118e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08", "content": "", "creation_timestamp": "2025-04-15T10:00:00.000000Z"}, {"uuid": "68dcaba3-4b74-4a6c-9cc9-19fba803270d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29004", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/6257", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-29004\n\ud83d\udd25 CVSS Score: 6.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n\ud83d\udd39 Description: hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to /app/options.py and the config_file_name parameter. Successful exploitation of this vulnerability could allow an attacker with user level privileges to obtain the content of arbitrary files on the file server within the scope of what the server process has access to. The root-cause of the vulnerability lies in the get_config function of the /app/modules/config/config.py file, which only checks for relative path traversal, but still allows to read files from absolute locations passed via the config_file_name parameter.\n\ud83d\udccf Published: 2023-04-17T18:34:07.972Z\n\ud83d\udccf Modified: 2025-03-03T19:19:37.825Z\n\ud83d\udd17 References:\n1. https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-7qqj-xhvr-46fv", "creation_timestamp": "2025-03-03T19:30:49.000000Z"}, {"uuid": "fc93361f-9be1-476a-b2e5-956227e348a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/4251", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aPoC repository for CVE-2023-29007\nURL\uff1ahttps://github.com/ethiack/CVE-2023-29007\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-04-26T14:35:07.000000Z"}, {"uuid": "d03909d1-9900-4e69-8ad0-ed3ce44e23c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/arvinclub1/99", "content": "CVE-2023-29007", "creation_timestamp": "2023-04-27T07:07:37.000000Z"}, {"uuid": "1a783baa-0ab6-4484-aeb5-ac73a804d6e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/arvinclub1/98", "content": "https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007", "creation_timestamp": "2023-04-27T07:06:35.000000Z"}, {"uuid": "5512a7ea-387c-4a4d-a054-61d35a821893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "Telegram/r1PFadb90p6lTxGnl_f2N-hr-frtiZS7amPP7ck3RpMYFQ", "content": "", "creation_timestamp": "2023-04-27T09:53:54.000000Z"}, {"uuid": "280e94f1-5508-4b22-a256-03ab899555d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/1468", "content": "CVE-2023-29007\nGit Arbitrary Configuration Injection\n*\nreadme\n*\nPOC exploit\n\n#git #exploit", "creation_timestamp": "2023-04-27T07:07:43.000000Z"}, {"uuid": "66a37ae7-83cb-498e-9ddc-3421ceb74582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "Telegram/fV81_v8x36zAgCL91UuHBTq-t7A1rFWRsLJmOGWfzfBQXhM", "content": "", "creation_timestamp": "2023-05-23T08:55:19.000000Z"}, {"uuid": "8af5d0a7-b3ea-4ed0-bb4f-09a28e235637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/crackcodes/3331", "content": "CVE-2023-29007 |\u00a0Git Arbitrary Configuration Injection\n\nDownload: https://system32.ink/news-feed/p/314/", "creation_timestamp": "2023-04-27T09:52:54.000000Z"}, {"uuid": "55470c93-dd68-4b01-b6e8-95aa25edc42e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29009", "type": "seen", "source": "https://t.me/cibsecurity/73096", "content": "\u203c CVE-2023-29009 \u203c\n\nbaserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-28T00:17:36.000000Z"}, {"uuid": "e6376dba-ac2d-4928-a1fa-e8b0b44bcde3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/cibsecurity/62860", "content": "\u203c CVE-2023-29007 \u203c\n\nGit is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-26T00:25:22.000000Z"}, {"uuid": "21d2048e-7d75-4d2a-8a2f-b6f38281bf13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29004", "type": "seen", "source": "https://t.me/cibsecurity/62298", "content": "\u203c CVE-2023-29004 \u203c\n\nhap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to /app/options.py and the config_file_name parameter. Successful exploitation of this vulnerability could allow an attacker with user level privileges to obtain the content of arbitrary files on the file server within the scope of what the server process has access to. The root-cause of the vulnerability lies in the get_config function of the /app/modules/config/config.py file, which only checks for relative path traversal, but still allows to read files from absolute locations passed via the config_file_name parameter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-17T22:28:27.000000Z"}, {"uuid": "266934af-e661-4e12-a4ed-7afd2d89ab71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29005", "type": "seen", "source": "https://t.me/cibsecurity/61801", "content": "\u203c CVE-2023-29005 \u203c\n\nFlask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-11T00:22:49.000000Z"}, {"uuid": "68605942-ac98-40d4-b5ce-e561ef84413d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29008", "type": "seen", "source": "https://t.me/cibsecurity/61571", "content": "\u203c CVE-2023-29008 \u203c\n\nThe SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at `kit/src/runtime/server/respond.js`. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed in versions prior to 1.15.2 by simply specifying an upper-cased `Content-Type` header value. The browser will not send uppercase characters, but this check does not block all expected CORS requests. If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users\u00e2\u20ac\u2122 accounts. This may lead to all POST operations requiring authentication being allowed in the following cases: If the target site sets `SameSite=None` on its auth cookie and the user visits a malicious site in a Chromium-based browser; if the target site doesn't set the `SameSite` attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off; and/or if the user is visiting a malicious site with a very outdated browser. SvelteKit 1.15.2 contains a patch for this issue. It is also recommended to explicitly set `SameSite` to a value other than `None` on authentication cookies especially if the upgrade cannot be done in a timely manner.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-06T20:27:10.000000Z"}, {"uuid": "d066e60e-6aa1-4a9f-80e8-dfc01ef9347a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29002", "type": "seen", "source": "https://t.me/cibsecurity/62428", "content": "\u203c CVE-2023-29002 \u203c\n\nCilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the `cilium-secrets` namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug output from the Cilium containers could use the resulting output to intercept and modify traffic to and from the affected cluster. Output of the sensitive information would occur at Cilium agent restart, when secrets in the namespace are modified, and on creation of Ingress or GatewayAPI resources. This vulnerability is fixed in Cilium releases 1.11.16, 1.12.9, and 1.13.2. Users unable to upgrade should disable debug mode.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-19T02:43:51.000000Z"}, {"uuid": "36626a37-0f98-433d-815d-cb054669fca0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29000", "type": "seen", "source": "https://t.me/cibsecurity/61398", "content": "\u203c CVE-2023-29000 \u203c\n\nThe Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-04T17:59:28.000000Z"}, {"uuid": "ff2a8283-aef9-4eb6-a4e2-57b3cf0eda4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3338", "content": "Git Arbitrary Configuration Injection (CVE-2023-29007) https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007", "creation_timestamp": "2026-08-03T01:29:05.169312Z"}, {"uuid": "8f9f612a-0981-42b6-a430-646508572e31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12351", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007_win-version*\nGithub: https://github.com/x-Defender/CVE-2023-29007_win-version", "creation_timestamp": "2026-07-31T00:00:05.584857Z"}, {"uuid": "45dc4f56-9b0a-406c-8f20-593657f747a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12201", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *git_for_windows-CVE-2023-29007*\nGithub: https://github.com/x-Defender/git_for_windows-CVE-2023-29007", "creation_timestamp": "2026-07-31T01:00:04.229913Z"}, {"uuid": "24c0b501-5260-4904-bedc-c932efcb977a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12084", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/omespino/CVE-2023-29007", "creation_timestamp": "2026-07-31T01:00:04.004458Z"}, {"uuid": "ef649420-8966-4a15-ba65-251192e0d35d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12349", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007_win-git*\nGithub: https://github.com/x-Defender/CVE-2023-29007_win-git", "creation_timestamp": "2026-07-31T01:00:04.617117Z"}, {"uuid": "db1d28fa-d1bf-4cc5-8337-000a85f09c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/11628", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/ethiack/CVE-2023-29007", "creation_timestamp": "2026-07-31T03:00:04.149926Z"}, {"uuid": "cfcf585e-738a-4f89-8f74-9d443c5b2a3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/8390", "content": "#exploit\n1. CVE-2023-29007:\nGit Arbitrary Configuration Injection\nhttps://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007\n\n2. CVE-2020-0796:\nWindows Protocol TestSuites is to trigger BSoD\nhttps://github.com/Ajomix/CVE-2020-0796", "creation_timestamp": "2024-03-19T03:31:34.000000Z"}, {"uuid": "b40cc8a7-9f9b-4e8f-9f91-8917aa2b10f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/11628", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/ethiack/CVE-2023-29007", "creation_timestamp": "2026-08-01T00:00:43.770458Z"}, {"uuid": "cadc598e-2d66-4788-ad9e-0f78e4dba6d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12084", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/omespino/CVE-2023-29007", "creation_timestamp": "2026-08-01T00:00:45.634773Z"}, {"uuid": "ca646666-69d6-4eb3-b540-8cca2fbf2410", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12201", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *git_for_windows-CVE-2023-29007*\nGithub: https://github.com/x-Defender/git_for_windows-CVE-2023-29007", "creation_timestamp": "2026-08-01T00:00:45.829422Z"}, {"uuid": "4da78387-6d21-449e-b354-a0c96c83c030", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/12349", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007_win-git*\nGithub: https://github.com/x-Defender/CVE-2023-29007_win-git", "creation_timestamp": "2026-08-01T00:00:46.246650Z"}, {"uuid": "211efd43-d029-4f16-ba00-4fd350b14842", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/3338", "content": "Git Arbitrary Configuration Injection (CVE-2023-29007) https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007", "creation_timestamp": "2026-08-02T18:00:04.962773Z"}, {"uuid": "f1bf1b2c-054c-4d24-a779-1211820ed628", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12084", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/omespino/CVE-2023-29007", "creation_timestamp": "2026-07-29T12:00:34.207579Z"}, {"uuid": "12c20d49-00d3-4e77-9259-a3bb24df4b00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/11628", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/ethiack/CVE-2023-29007", "creation_timestamp": "2026-07-29T12:00:35.542230Z"}, {"uuid": "4a5066f9-229b-4b3c-8387-0355919eee62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12349", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007_win-git*\nGithub: https://github.com/x-Defender/CVE-2023-29007_win-git", "creation_timestamp": "2026-07-29T12:00:33.790701Z"}, {"uuid": "c25c6e53-89fb-4f2f-93a3-5dc76aa6d71e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12201", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *git_for_windows-CVE-2023-29007*\nGithub: https://github.com/x-Defender/git_for_windows-CVE-2023-29007", "creation_timestamp": "2026-07-29T12:00:34.061440Z"}, {"uuid": "5a66a4e2-f855-4bf5-b9f1-5b490c3d81a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12351", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007_win-version*\nGithub: https://github.com/x-Defender/CVE-2023-29007_win-version", "creation_timestamp": "2026-07-29T12:00:33.632324Z"}, {"uuid": "2c13124e-6a42-4fb7-9b7f-66eb9c634b87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/reverseame/3338", "content": "Git Arbitrary Configuration Injection (CVE-2023-29007) https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007", "creation_timestamp": "2026-07-29T12:02:29.781732Z"}, {"uuid": "ee5321bf-b02d-4f42-b492-ffef110c8c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12351", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007_win-version*\nGithub: https://github.com/x-Defender/CVE-2023-29007_win-version", "creation_timestamp": "2026-07-30T00:00:59.003600Z"}, {"uuid": "6f554043-37a0-4bf5-bfca-8c28cfc32b60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12349", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007_win-git*\nGithub: https://github.com/x-Defender/CVE-2023-29007_win-git", "creation_timestamp": "2026-07-30T00:00:59.198246Z"}, {"uuid": "361c21f3-e472-4c5f-bcef-f180d6fa7a1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12201", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *git_for_windows-CVE-2023-29007*\nGithub: https://github.com/x-Defender/git_for_windows-CVE-2023-29007", "creation_timestamp": "2026-07-30T00:00:59.615887Z"}, {"uuid": "ae2567ce-5191-4ea6-94b5-8d6a026e684c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/12084", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/omespino/CVE-2023-29007", "creation_timestamp": "2026-07-30T00:00:59.821288Z"}, {"uuid": "b4fe29b8-2753-4d9a-9f84-9284491ca4c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/CVEhub/11628", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2023\nName: *CVE-2023-29007*\nGithub: https://github.com/ethiack/CVE-2023-29007", "creation_timestamp": "2026-07-30T00:01:02.037128Z"}, {"uuid": "35a7f0cc-49e8-44df-a4d9-dce34460df95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/reverseame/3338", "content": "Git Arbitrary Configuration Injection (CVE-2023-29007) https://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007", "creation_timestamp": "2026-07-30T00:02:30.474485Z"}, {"uuid": "20d5e14e-f0b2-4d2d-8964-7d9fb28be3e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/hacking_Attack/99459", "content": "https://external-preview.redd.it/gV4Noo60pixEn1crBPMSCwqitM9E5qnaJstNqsHXHjg.jpg?width=640&crop=smart&auto=webp&s=89e5ab881d2574c516cca27bb5aa59b4a986c942 Hello all,\n\nWanted to share more about a recent CVE (CVE-2023-29007) we've found. It has been assigned a CVSS score of 7.0/10 (high). I believe it might be useful to share this with you.\n\nGit\u2019s implementation used to rename or delete sections of a configuration file contained a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections.\n\nWhen attempting to rename or remove a malicious configuration section, this can result in arbitrary configuration injection into a user\u2019s .git/config. This may be used to achieve arbitrary code execution via configuration values that specify executables, such as core.pager, core.editor, and core.sshCommand.\n\nThis vulnerability may be exploited by using overly-long submodule URLs, which are stored in a user\u2019s .git/config upon initialization. Those URLs may be misinterpreted as containing new configuration material when removing those sections, for example, with git submodule deinit.\n\nExploiting this issue can be complex since it requires user interaction via legitimate git commands.\n\nSources:\n\nhttps://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/\n\nhttps://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844\n\nIntro\n\nAt Ethiack, we rely on git submodules to share common code across multiple components. We realized a weird behaviour on Github itself, with submodule URLs that would crash the GitHub repository page, while doing bug bounties on HackerOne\n\nThen, we dived into the git code base and started fuzzing it. We didn\u2019t get any crashes, but after a while, we realized that deinitializing submodules would somehow create new sections in .git/config.\n\nThe Vulnerability \n\nIn config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):In config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):\n\n\u200b\n\nhttps://preview.redd.it/w9sfmfcqnawa1.png?width=2048&format=png&auto=webp&s=f9439f62bcd355e6fe07393c6ce501fbd4f3cbe4\n\nNotice the:\n\n/* it's a section */\n\nWell... what if it's not a section? :)\n\nWhen we have a config file line larger than 1024 characters, fgets will be called one more time, even if there\u2019s no new line in the config file. If the first character of the buffer, or the first character after space characters is a \u2018[\u2018 character, a new section will be created in .git/config if the original section is being removed or renamed.\nThis means that any section variable larger than 1024 bytes that satisfies these conditions and is[...]", "creation_timestamp": "2026-09-01T20:00:59.303213Z"}, {"uuid": "b46f69d8-43d6-4fef-a0e6-6996fa2d0610", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "seen", "source": "https://t.me/hacking_Attack/99459", "content": "https://external-preview.redd.it/gV4Noo60pixEn1crBPMSCwqitM9E5qnaJstNqsHXHjg.jpg?width=640&crop=smart&auto=webp&s=89e5ab881d2574c516cca27bb5aa59b4a986c942 Hello all,\n\nWanted to share more about a recent CVE (CVE-2023-29007) we've found. It has been assigned a CVSS score of 7.0/10 (high). I believe it might be useful to share this with you.\n\nGit\u2019s implementation used to rename or delete sections of a configuration file contained a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections.\n\nWhen attempting to rename or remove a malicious configuration section, this can result in arbitrary configuration injection into a user\u2019s .git/config. This may be used to achieve arbitrary code execution via configuration values that specify executables, such as core.pager, core.editor, and core.sshCommand.\n\nThis vulnerability may be exploited by using overly-long submodule URLs, which are stored in a user\u2019s .git/config upon initialization. Those URLs may be misinterpreted as containing new configuration material when removing those sections, for example, with git submodule deinit.\n\nExploiting this issue can be complex since it requires user interaction via legitimate git commands.\n\nSources:\n\nhttps://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/\n\nhttps://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844\n\nIntro\n\nAt Ethiack, we rely on git submodules to share common code across multiple components. We realized a weird behaviour on Github itself, with submodule URLs that would crash the GitHub repository page, while doing bug bounties on HackerOne\n\nThen, we dived into the git code base and started fuzzing it. We didn\u2019t get any crashes, but after a while, we realized that deinitializing submodules would somehow create new sections in .git/config.\n\nThe Vulnerability \n\nIn config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):In config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):\n\n\u200b\n\nhttps://preview.redd.it/w9sfmfcqnawa1.png?width=2048&format=png&auto=webp&s=f9439f62bcd355e6fe07393c6ce501fbd4f3cbe4\n\nNotice the:\n\n/* it's a section */\n\nWell... what if it's not a section? :)\n\nWhen we have a config file line larger than 1024 characters, fgets will be called one more time, even if there\u2019s no new line in the config file. If the first character of the buffer, or the first character after space characters is a \u2018[\u2018 character, a new section will be created in .git/config if the original section is being removed or renamed.\nThis means that any section variable larger than 1024 bytes that satisfies these conditions and is[...]", "creation_timestamp": "2026-09-02T01:01:19.950776Z"}, {"uuid": "e094a797-be18-45ed-8f43-9466ecac963a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/99459", "content": "https://external-preview.redd.it/gV4Noo60pixEn1crBPMSCwqitM9E5qnaJstNqsHXHjg.jpg?width=640&crop=smart&auto=webp&s=89e5ab881d2574c516cca27bb5aa59b4a986c942 Hello all,\n\nWanted to share more about a recent CVE (CVE-2023-29007) we've found. It has been assigned a CVSS score of 7.0/10 (high). I believe it might be useful to share this with you.\n\nGit\u2019s implementation used to rename or delete sections of a configuration file contained a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections.\n\nWhen attempting to rename or remove a malicious configuration section, this can result in arbitrary configuration injection into a user\u2019s .git/config. This may be used to achieve arbitrary code execution via configuration values that specify executables, such as core.pager, core.editor, and core.sshCommand.\n\nThis vulnerability may be exploited by using overly-long submodule URLs, which are stored in a user\u2019s .git/config upon initialization. Those URLs may be misinterpreted as containing new configuration material when removing those sections, for example, with git submodule deinit.\n\nExploiting this issue can be complex since it requires user interaction via legitimate git commands.\n\nSources:\n\nhttps://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/\n\nhttps://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844\n\nIntro\n\nAt Ethiack, we rely on git submodules to share common code across multiple components. We realized a weird behaviour on Github itself, with submodule URLs that would crash the GitHub repository page, while doing bug bounties on HackerOne\n\nThen, we dived into the git code base and started fuzzing it. We didn\u2019t get any crashes, but after a while, we realized that deinitializing submodules would somehow create new sections in .git/config.\n\nThe Vulnerability \n\nIn config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):In config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):\n\n\u200b\n\nhttps://preview.redd.it/w9sfmfcqnawa1.png?width=2048&format=png&auto=webp&s=f9439f62bcd355e6fe07393c6ce501fbd4f3cbe4\n\nNotice the:\n\n/* it's a section */\n\nWell... what if it's not a section? :)\n\nWhen we have a config file line larger than 1024 characters, fgets will be called one more time, even if there\u2019s no new line in the config file. If the first character of the buffer, or the first character after space characters is a \u2018[\u2018 character, a new section will be created in .git/config if the original section is being removed or renamed.\nThis means that any section variable larger than 1024 bytes that satisfies these conditions and is[...]", "creation_timestamp": "2026-09-04T15:00:05.164147Z"}, {"uuid": "938af3fa-91a3-4864-ace4-1cccf327ce66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29007", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/99459", "content": "https://external-preview.redd.it/gV4Noo60pixEn1crBPMSCwqitM9E5qnaJstNqsHXHjg.jpg?width=640&crop=smart&auto=webp&s=89e5ab881d2574c516cca27bb5aa59b4a986c942 Hello all,\n\nWanted to share more about a recent CVE (CVE-2023-29007) we've found. It has been assigned a CVSS score of 7.0/10 (high). I believe it might be useful to share this with you.\n\nGit\u2019s implementation used to rename or delete sections of a configuration file contained a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections.\n\nWhen attempting to rename or remove a malicious configuration section, this can result in arbitrary configuration injection into a user\u2019s .git/config. This may be used to achieve arbitrary code execution via configuration values that specify executables, such as core.pager, core.editor, and core.sshCommand.\n\nThis vulnerability may be exploited by using overly-long submodule URLs, which are stored in a user\u2019s .git/config upon initialization. Those URLs may be misinterpreted as containing new configuration material when removing those sections, for example, with git submodule deinit.\n\nExploiting this issue can be complex since it requires user interaction via legitimate git commands.\n\nSources:\n\nhttps://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/\n\nhttps://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844\n\nIntro\n\nAt Ethiack, we rely on git submodules to share common code across multiple components. We realized a weird behaviour on Github itself, with submodule URLs that would crash the GitHub repository page, while doing bug bounties on HackerOne\n\nThen, we dived into the git code base and started fuzzing it. We didn\u2019t get any crashes, but after a while, we realized that deinitializing submodules would somehow create new sections in .git/config.\n\nThe Vulnerability \n\nIn config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):In config.c, the function git_config_copy_or_rename_section_in_file uses a buffer with a length of 1024 characters. There\u2019s no buffer overflow here since fgets is being called with sizeof(buf):\n\n\u200b\n\nhttps://preview.redd.it/w9sfmfcqnawa1.png?width=2048&format=png&auto=webp&s=f9439f62bcd355e6fe07393c6ce501fbd4f3cbe4\n\nNotice the:\n\n/* it's a section */\n\nWell... what if it's not a section? :)\n\nWhen we have a config file line larger than 1024 characters, fgets will be called one more time, even if there\u2019s no new line in the config file. If the first character of the buffer, or the first character after space characters is a \u2018[\u2018 character, a new section will be created in .git/config if the original section is being removed or renamed.\nThis means that any section variable larger than 1024 bytes that satisfies these conditions and is[...]", "creation_timestamp": "2026-09-05T01:00:25.220769Z"}]}