CVE-2023-49569

What it actually does

Path traversal in go-git ChrootOS allows creation and modification of arbitrary files on the host filesystem when using PlainOpen or PlainClone, enabling remote code execution in the worst case.

Why it matters to the business

Attackers could gain full control of servers that clone untrusted repositories, resulting in data theft, service disruption, or ransomware deployment; the issue affects many Go projects and has been public for nearly three years.

How an attack unfolds

An attacker crafts a malicious Git repository containing path traversal sequences that escape the chroot jail when processed by go-git’s default PlainClone or PlainOpen functions; once files can be written anywhere on disk, the attacker plants executables in locations such as cron directories, systemd units, or shell profile files that are later executed with the privileges of the cloning process.

How to fix it

Upgrade go-git to a version containing commit 5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca (equivalent to v5.11 or later). Applications that cannot upgrade should switch from ChrootOS to BoundOS or an in-memory filesystem.

How to confirm the fix worked

Confirm the go-git dependency version is at or above the fixed commit; run integration tests that exercise PlainClone against a repository containing traversal sequences and verify no files are written outside the target directory.

Typical attack path

1. Host an attacker-controlled Git repository containing traversal payloads
2. Trick the victim application into calling PlainClone or PlainOpen against the repository
3. Exploit ChrootOS to write files outside the intended working directory
4. Place a payload in a location executed automatically by the host OS or application
5. Trigger execution of the planted payload to achieve remote code execution

How to detect it

Review application and system logs for unexpected file creation or modification timestamps around the time of repository clone operations; inspect process execution history for binaries or scripts appearing in system directories shortly after a clone; correlate clone activity with subsequent privilege-escalation or persistence artifacts.

What your security team should do

• Immediately inventory all Go codebases that import go-git and identify those using PlainClone or PlainOpen
• Upgrade every affected module to the fixed commit or later release
• Replace ChrootOS usage with BoundOS wherever possible until upgrades are complete
• Add dependency scanning to CI pipelines to block future vulnerable versions
• Monitor for new go-git releases and schedule periodic dependency updates