Arbitrary Code Execution via Clean/Smudge Filters and Symlinks in Git (CVE-2021-21300)

This repository demonstrates a proof-of-concept exploit for CVE-2021-21300, a vulnerability in Git (versions 2.14.2 to 2.30.1) affecting case-insensitive filesystems (Windows/macOS). The exploit leverages symbolic links and Git LFS filters to inject a malicious 'post-checkout' hook into the victim's .git/hooks directory. The repository contains a .gitattributes file to trigger LFS processing, a directory 'A' with files mimicking legitimate content, and a file 'A/post-checkout' which is intended to be executed as a malicious hook. The README.md provides a detailed explanation of the vulnerability, attack workflow, and possible defenses. No actual exploit script is present, but the structure and instructions clearly demonstrate how to set up the attack. The exploit is local, requiring the victim to clone the repository under specific conditions, after which arbitrary code execution is possible via the malicious hook.

This repository contains a single Metasploit module (git_lfs_clone_command_exec.rb) that exploits CVE-2021-21300, a vulnerability in Git clients supporting delay-capable clean/smudge filters (such as Git LFS) on case-insensitive file systems (MacOS, Windows). The exploit works by serving a malicious Git repository over HTTP. When a victim clones this repository, the exploit leverages Git LFS and symbolic links to place a malicious 'post-checkout' hook in the .git/hooks directory of the victim's local repository. This hook contains a shell payload (typically a reverse shell or arbitrary command) that is executed automatically upon checkout. The module is weaponized, allowing the attacker to easily customize the payload. The main attack vector is network-based, requiring the victim to clone the attacker's repository. The endpoints of interest are the HTTP path to the malicious repository and the file path of the malicious Git hook. The module is operational and ready for use within the Metasploit framework.