CVE-2023-4759

What it actually does

Symbolic links in specially crafted git repositories enable arbitrary file writes outside the working tree on case-insensitive filesystems during clone, checkout, merge, pull, or patch apply operations, which can be abused for remote code execution such as installing malicious git filters.

Why it matters to the business

Development and CI environments using affected JGit versions on Windows or macOS face elevated risk of supply-chain compromise and unauthorized code execution, potentially affecting code integrity across projects and downstream dependents.

How an attack unfolds

An attacker crafts a repository containing a symlink pointing outside the working tree, hosts it publicly or via social engineering, and waits for a victim to clone or checkout on a case-insensitive filesystem with symlinks enabled; subsequent git operations then execute attacker-controlled content such as filters.

How to fix it

Upgrade Eclipse JGit to 6.6.1.202309021850-r, 6.7.0.202309050840-r, or the 5.13.3.202401111512-r backport. Set git configuration option core.symlinks=false before any clone or checkout operations on case-insensitive filesystems. Apply the exact fixed commits d3962e0e722f40c02e06e785e0ec62fe1c536d7f for jgit and b886c60c6af24561c805d1d7a2dd6cc0618a53c7 for mediawiki where applicable.

How to confirm the fix worked

Confirm JGit version is at or above the fixed releases, verify core.symlinks=false setting, and test cloning a crafted repository containing symlinks on a case-insensitive filesystem to ensure writes remain confined to the working tree.

Typical attack path

1. Create malicious git repository containing symlink to target location outside working tree
2. Host repository or distribute via social engineering
3. Victim performs clone, checkout, merge, or pull on case-insensitive filesystem with core.symlinks enabled
4. Files are written outside intended directory, for example installing malicious git filter
5. Attacker achieves code execution on next git operation

How to detect it

Review git operation logs for unexpected file writes or symlink usage during clone/checkout/merge/pull, inspect repositories for symlinks pointing outside the tree, and examine process execution of git filters or hooks installed outside expected directories.

What your security team should do

• Immediately upgrade all JGit installations to a fixed version
• Disable symlinks via core.symlinks=false in git configuration for Windows and macOS environments
• Scan repositories and build pipelines for use of vulnerable JGit versions
• Monitor for unexpected file writes during git operations
• Prioritize remediation for any public-facing or high-privilege clone operations