CVE-2024-50349

What it actually does

Git prints URL-decoded hostnames containing ANSI escape sequences verbatim during terminal credential prompts, enabling visual spoofing of the target host in the prompt text.

Why it matters to the business

Attackers can obtain developer credentials for trusted repositories by tricking users during clone operations from untrusted sources, leading to source code theft, supply chain compromise, or unauthorized repository access; high ecosystem prevalence increases exposure across many development environments.

How an attack unfolds

An attacker crafts a malicious URL embedding ANSI escape sequences that decode to mimic a trusted host, then lures a victim into cloning from it (especially recursive clones); Git decodes and prints the hostname in the credential prompt, causing the user to enter credentials for the attacker's controlled site instead.

How to fix it

Upgrade Git to one of the fixed releases v2.48.1, v2.47.1, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, or v2.40.4. Users unable to upgrade must avoid cloning from untrusted URLs, especially recursive clones.

How to confirm the fix worked

Verify installed Git version is at or above a fixed release; test by attempting a clone with a crafted URL containing ANSI sequences and confirm the prompt no longer displays decoded escape sequences verbatim.

Typical attack path

1. Craft URL with ANSI escapes that visually spoof a trusted Git host after decoding
2. Distribute the malicious URL via phishing, malicious README, or dependency links
3. Victim performs git clone or submodule update from the URL
4. Git prompts for credentials and displays the spoofed hostname
5. Victim supplies credentials believing they are for the trusted host
6. Credentials are sent to attacker-controlled server

How to detect it

Search terminal histories, shell logs, and Git credential helper logs for clones involving URLs with percent-encoded sequences or unusual hostnames; monitor for credential prompts displaying unexpected or obfuscated host information.

What your security team should do

• Immediately upgrade all Git installations to a patched version listed in remediation guidance
• Block or monitor for clones from untrusted or newly observed remote URLs in CI/CD and developer workflows
• Educate developers on verifying repository URLs before cloning, especially recursive operations
• Review recent clone activity logs for suspicious or unexpected remote hosts