CVE-2017-8386

What it actually does

git-shell accepts repository names beginning with a dash and passes them directly to git commands, enabling injection of arbitrary command-line options that can lead to privilege escalation for authenticated users.

Why it matters to the business

Attackers who already have limited git access can obtain full system control, exposing source code, intellectual property, and any data reachable from the git server account.

How an attack unfolds

An authenticated user supplies a repository name that begins with a dash followed by a git option or shell command; git-shell invokes the underlying git binary with the malicious argument, causing unintended command execution and privilege gain.

How to fix it

Upgrade git to a fixed release (2.4.12, 2.5.6, 2.6.7, 2.7.5, 2.8.5, 2.9.4, 2.10.3, 2.11.2, 2.12.3 or later). For wordpress/wordpress (GIT) apply commit dd2d8110a94de43a72926e269056f45f2904b45c. Restrict git-shell access to only trusted users until patches are deployed.

How to confirm the fix worked

Confirm the installed git version is at or above one of the listed fixed releases; attempt to create a test repository whose name begins with a dash and verify that git-shell rejects it with an error rather than executing injected options.

Typical attack path

1. Obtain valid credentials for a git-shell account
2. Create or reference a repository whose name starts with a dash and contains a command injection payload
3. Invoke git-shell (via SSH or other allowed transport) with the malicious repository name
4. Execute arbitrary commands or escalate to higher privileges on the host

How to detect it

Review git server logs (sshd, git-shell invocation logs) and repository creation records for names that begin with a hyphen; correlate with successful command execution or unexpected file modifications performed under the git user account.

• repository name starting with '-'
• git-shell invocation containing '-exec' or other injected options
• unexpected process spawns from git-shell or git-upload-pack under the git user

What your security team should do

• Immediately patch all git installations to the versions listed in remediation guidance
• Audit which accounts are permitted to use git-shell and reduce the set to the minimum required
• Monitor for new repository creation events that contain leading dash characters in their names