CVE-2022-25648

What it actually does

Unsanitized remote parameter in fetch() allows arbitrary git flags to be passed to the underlying git fetch subcommand, enabling command injection.

Why it matters to the business

Attackers can execute arbitrary commands on servers running affected ruby-git versions, resulting in full system compromise, data exfiltration, or lateral movement. The vulnerability has been public for over four years with public exploits available, though no widespread ransomware or named APT campaigns are recorded.

How an attack unfolds

An attacker supplies a malicious remote value containing git flags such as --upload-pack to the fetch method; the library passes the value directly to the git binary, causing the injected command to execute with the privileges of the calling process.

How to fix it

Upgrade ruby-git to the commit 546bc038ff6604f8304fdeca738c2a7c20cbacc8 (version 1.11.0 or later). If immediate upgrade is not possible, sanitize all remote and option parameters before passing them to fetch or switch to a different git library.

How to confirm the fix worked

Verify the installed ruby-git gem version is 1.11.0 or newer; re-run unit tests covering fetch with remote parameters; attempt a safe PoC injection in a non-production environment and confirm the command is rejected.

Typical attack path

1. Locate an application that invokes ruby-git fetch(remote, opts) with attacker-controlled input
2. Craft a remote string containing git argument injection payloads (e.g., --upload-pack='sh -c ...')
3. Trigger the fetch call via network request, API, or scheduled job
4. Execute arbitrary OS commands and establish persistence or exfiltrate data

How to detect it

Search application and system logs for ruby processes invoking git fetch with unexpected flags or shell metacharacters in the remote argument; inspect for child processes such as sh or curl spawned immediately after git operations.

• fetch.*--upload-pack
• git fetch.*[;&|`$]
• ruby.*git.*fetch.*origin

What your security team should do

• Upgrade all instances of ruby-git to the fixed commit immediately
• Audit code for direct use of fetch with untrusted remote values
• Add runtime monitoring for unexpected child processes spawned by ruby processes
• Review dependency manifests for transitive ruby-git usage across the ecosystem