Git Client RCE & Submodule Vulnerabilities (CVE-2022-24765 & CVE-2024-32002)

1. When 'git clone' Becomes a Weapon

For software engineers and DevOps teams, running git clone <repo> is a daily, reflexive action presumed to be safe. In 2022 and 2024, critical vulnerabilities in the core Git client demonstrated that cloning an untrusted Git repository could execute arbitrary malicious code on developer laptops and automated CI/CD runners before any build scripts were ever triggered: CVE-2022-24765 and CVE-2024-32002 (CVSS 9.0).

2. Git Client CVE Comparison Matrix

3. Technical Root Cause: CVE-2024-32002 Submodule Hook Overwrite

Git submodules are embedded Git repositories stored in .git/modules/<name>/. Git hooks (like post-checkout) reside in .git/hooks/ and execute automatically during clone operations.

On case-insensitive filesystems (APFS on macOS, NTFS on Windows), the filesystem treats .GIT and .git as identical directory paths. An attacker crafted a repository containing:

1. A symbolic link named A/modules/x pointing to ../../.git/modules/x.
2. A submodule configured with a path named a/modules/x containing a malicious hooks/post-checkout script.

When Git cloned the repository recursively with git clone --recursive, it followed the symlink and wrote the submodule's hook files directly into the top-level repository's .git/hooks/post-checkout path, executing the script immediately upon checkout without user interaction.

4. Remediation & Developer Workstation Hardening

# Upgrade Git CLI to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, or 2.40.2+
git --version

# Disable automated symbolic link resolution during submodule cloning if unpatched
git config --global core.symlinks false