CVE-2014-9390

What it actually does

Improper handling of case, Unicode codepoints, and alternate filename representations on case-insensitive filesystems allows a remote Git server to cause a crafted .git/config file to be written and subsequently processed, resulting in arbitrary command execution during clone or other operations.

Why it matters to the business

Developers and organizations using affected Git, Mercurial, Xcode, and related tools on Windows or macOS face risk of full workstation compromise, theft of source code and credentials, and supply-chain insertion when cloning repositories from untrusted sources; the high EPSS and weaponized exploit maturity increase urgency for any remaining unpatched systems despite the CVE age.

How an attack unfolds

An attacker hosts a malicious repository containing a tree entry that resolves to .git/config via case folding, git~1, or ignorable Unicode on Windows or macOS; when a victim clones or updates from the repo, the client writes and interprets the attacker-controlled config, executing arbitrary commands such as shell hooks or credential exfiltration.

How to fix it

Upgrade Git to 1.8.5.6+, 1.9.5+, 2.0.5+, 2.1.4+, or 2.2.1+; upgrade Mercurial to 3.2.3+; upgrade Apple Xcode to 6.2 beta 3 or later; upgrade libgit2 past 0.21.2; update EGit and JGit to versions released after 2014-08-12; avoid cloning repositories from untrusted sources until patched.

How to confirm the fix worked

Verify client versions meet or exceed the minimums listed in remediation; test clone operations against a synthetic malicious repository that exercises the case/Unicode config paths; confirm no .git/config files with unexpected hook or alias entries appear after clone on case-insensitive volumes.

Typical attack path

1. Attacker creates or compromises a Git repository containing a malicious tree entry for the config file using case/Unicode tricks
2. Victim performs git clone or fetch against the malicious repository on a case-insensitive filesystem
3. Client writes the attacker-supplied config into the local .git directory
4. Git processes the malicious configuration and executes embedded commands or hooks
5. Attacker gains code execution, credential access, or persistence on the victim workstation

How to detect it

Search Git and Mercurial client logs for clones of repositories containing .git/config entries created via case folding or Unicode; inspect post-clone .git/config files for unexpected core.hooksPath, alias, or credential helper settings; correlate with process execution of commands listed in those configs.

• .git/config containing core.hooksPath
• git clone.*~1/
• Unicode U+200C or U+200D in repository tree entries
• git~1/config file creation events

What your security team should do

• Immediately inventory and upgrade all developer workstations and CI systems running affected Git, Mercurial, Xcode, libgit2, EGit, or JGit versions
• Block or monitor outbound clones from untrusted or newly created repositories until patch deployment completes
• Add repository-clone logging and .git/config change detection to endpoint monitoring for the next 90 days