CVE-2017-1000117

What it actually does

The flaw permits arbitrary program execution on the victim host when a crafted ssh:// URL is processed during Git submodule initialization, bypassing intended URL handling restrictions.

Why it matters to the business

Attackers can achieve remote code execution on developer workstations and CI/CD systems, enabling malware deployment, credential theft, or compromise of source code repositories; the high EPSS and weaponized exploit maturity increase urgency for organizations relying on Git.

How an attack unfolds

An attacker publishes a malicious repository containing a .gitmodules file with an ssh:// URL that references an attacker-controlled command; when a victim runs git clone --recurse-submodules, Git invokes the referenced program, achieving code execution. The issue has been weaponized and carries elevated exploitation probability.

How to fix it

Upgrade Git to a patched release that correctly sanitizes ssh:// URLs in submodule configurations; disable recursive submodule cloning via repository policy or client configuration where feasible; monitor for and remove untrusted .gitmodules entries.

How to confirm the fix worked

Verify Git version is newer than the vulnerable releases; attempt to clone a test repository containing a known-bad ssh:// submodule URL and confirm the command is rejected or sanitized; review .gitmodules files in all repositories for unexpected ssh:// entries.

Typical attack path

1. Craft a malicious Git repository with a .gitmodules file embedding an ssh:// URL pointing to an arbitrary executable
2. Host the repository on a public or accessible forge
3. Social-engineer the victim into executing git clone --recurse-submodules against the repository
4. Git processes the submodule URL and executes the attacker-chosen program on the victim host

How to detect it

Inspect Git client logs, shell history, and CI pipeline output for clone operations that include --recurse-submodules combined with unusual ssh:// URLs; search repository histories for .gitmodules files containing ssh:// schemes.

What your security team should do

• Immediately upgrade all Git installations to a fixed version
• Enforce repository policies that prohibit or scan for ssh:// URLs in .gitmodules
• Disable --recurse-submodules in automated clone workflows until patches are deployed
• Add Git client version checks to build and developer onboarding processes