CVE-2024-53263

What it actually does

Git LFS passes unsanitized portions of a remote host URL containing URL-encoded line feed or carriage return characters to the git-credential helper and forwards any returned credentials back to the attacker-controlled host.

Why it matters to the business

Stolen Git credentials can allow attackers to access private repositories, modify source code, exfiltrate intellectual property, or pivot into connected CI/CD and deployment systems.

How an attack unfolds

An attacker embeds URL-encoded control characters in a Git remote URL, causes a victim to perform a Git LFS operation against that URL, intercepts the credential request forwarded by Git LFS to the system's credential helper, and receives the user's Git credentials for the original host.

How to fix it

Upgrade git-lfs to version 3.6.1 or later (commit ea47a34bde1ba1ecf9eb8dc6d44fcf7aef42f5e3). No workarounds exist; replace all older installations.

How to confirm the fix worked

Run `git-lfs version` and confirm 3.6.1 or newer; test credential helper behavior with a URL containing %0A or %0D to verify sanitization.

Typical attack path

1. Attacker crafts a malicious remote URL containing URL-encoded LF or CR characters
2. Victim clones or interacts with a repository using Git LFS and the malicious URL
3. Git LFS requests credentials from the git-credential helper using the tampered URL
4. Credential helper returns stored credentials for the target host
5. Git LFS forwards those credentials to the attacker-controlled endpoint

How to detect it

Review Git and Git LFS logs for remote URLs containing percent-encoded line breaks (%0A, %0D), unusual credential-helper calls, or outbound credential transmissions to unexpected hosts.

• %0A
• %0D
• git-credential.*url=.*%0
• credential.*LF
• credential.*CR

What your security team should do

• Immediately upgrade all git-lfs installations to 3.6.1
• Audit recent Git LFS operations for unexpected remote hosts
• Rotate any Git credentials that may have been exposed via this vector
• Add monitoring for credential-helper invocations with control characters in logs