Version
7.8.0.202609011348-r
Operating System
Linux/Unix
Bug description
JGit's fetch client accepts a remote-advertised ref name containing .. and
carries it through the default bare-clone refspec into the file-backed ref
database. The attached server advertises:
refs/heads/../../../victim.git/refs/heads/main
The first bare clone records the logical ref. On a subsequent fetch, the
expanded destination resolves outside the target repository and addresses the
main ref in a sibling victim.git repository.
Actual behavior
The fetch completes successfully and replaces the sibling repository's ref
with the object ID supplied by the remote:
target=target.git
victim-ref=victim.git/refs/heads/main
victim-ref-replaced=true
victim-ref-content=286060ec85628e19c00857f70f34805a115130f7
Expected behavior
The remote ref should be rejected before it enters the local refspec and
file-backed ref update path. The sibling repository's ref should remain
unchanged, and no traversal-shaped ref should be persisted in the target
repository.
Relevant log output
JGit 7.8.0.202609011348-r: victim-ref-replaced=true
JGit 7.9.0-SNAPSHOT (87ec2100): victim-ref-replaced=true
Git core check-ref-format control: rejected
Other information
This gives an untrusted Git server a path traversal into a sibling repository
whenever a JGit client fetches into a filesystem containing other writable
repositories. Repository mirrors, bare caches, build inputs, and server-side
management jobs can have another checkout's branch redirected by a successful
fetch.
The reproducer is a standalone Maven project that uses JGit as both the local
client and test server. It requires Java 17 or newer and Maven 3.8 or newer;
Maven resolves the pinned release dependency. The detailed protocol and
filesystem source analysis is in report.md, and the complete
reproducer and sanitized evidence are in attachments.zip.
Relevant source paths at the audited revision include
BasePackConnection,
RefSpec,
and RefDirectory.fileFor.
Attachments
detailed report.md
attachments.zip
Version
7.8.0.202609011348-r
Operating System
Linux/Unix
Bug description
JGit's fetch client accepts a remote-advertised ref name containing
..andcarries it through the default bare-clone refspec into the file-backed ref
database. The attached server advertises:
The first bare clone records the logical ref. On a subsequent fetch, the
expanded destination resolves outside the target repository and addresses the
mainref in a siblingvictim.gitrepository.Actual behavior
The fetch completes successfully and replaces the sibling repository's ref
with the object ID supplied by the remote:
Expected behavior
The remote ref should be rejected before it enters the local refspec and
file-backed ref update path. The sibling repository's ref should remain
unchanged, and no traversal-shaped ref should be persisted in the target
repository.
Relevant log output
Other information
This gives an untrusted Git server a path traversal into a sibling repository
whenever a JGit client fetches into a filesystem containing other writable
repositories. Repository mirrors, bare caches, build inputs, and server-side
management jobs can have another checkout's branch redirected by a successful
fetch.
The reproducer is a standalone Maven project that uses JGit as both the local
client and test server. It requires Java 17 or newer and Maven 3.8 or newer;
Maven resolves the pinned release dependency. The detailed protocol and
filesystem source analysis is in
report.md, and the completereproducer and sanitized evidence are in
attachments.zip.Relevant source paths at the audited revision include
BasePackConnection,RefSpec,and
RefDirectory.fileFor.Attachments
detailed report.md
attachments.zip