{"uuid": "ccbea33d-9caf-430b-bc71-c4ca2dd74df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-9390", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/git_client_command_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Jon Hart \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits CVE-2014-9390, which affects Git (versions less\\n          than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1) and Mercurial (versions\\n          less than 3.2.3) and describes three vulnerabilities.\\n\\n          On operating systems which have case-insensitive file systems, like\\n          Windows and OS X, Git clients can be convinced to retrieve and\\n          overwrite sensitive configuration files in the .git\\n          directory which can allow arbitrary code execution if a vulnerable\\n          client can be convinced to perform certain actions (for example,\\n          a checkout) against a malicious Git repository.\\n\\n          A second vulnerability with similar characteristics also exists in both\\n          Git and Mercurial clients, on HFS+ file systems (Mac OS X) only, where\\n          certain Unicode codepoints are ignorable.\\n\\n          The third vulnerability with similar characteristics only affects\\n          Mercurial clients on Windows, where Windows \\\"short names\\\"\\n          (MS-DOS-compatible 8.3 format) are supported.\\n\\n          Today this module only truly supports the first vulnerability (Git\\n          clients on case-insensitive file systems) but has the functionality to\\n          support the remaining two with a little work.\", \"disclosure_date\": \"2014-12-18\", \"fullname\": \"exploit/multi/http/git_client_command_exec\", \"is_install_path\": true, \"mod_time\": \"2025-06-20 13:20:44 +0000\", \"name\": \"Malicious Git and Mercurial HTTP Server For CVE-2014-9390\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"screen-effects\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/git_client_command_exec.rb\", \"platform\": \"Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/git_client_command_exec\", \"references\": [\"CVE-2014-9390\", \"URL-https://www.rapid7.com/blog/post/2015/01/01/12-days-of-haxmas-exploiting-cve-2014-9390-in-git-and-mercurial\", \"URL-http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html\", \"URL-http://article.gmane.org/gmane.linux.kernel/1853266\", \"URL-https://github.com/blog/1938-vulnerability-announced-update-your-git-clients\", \"URL-https://www.mehmetince.net/one-git-command-may-cause-you-hacked-cve-2014-9390-exploitation-for-shell/\", \"URL-http://web.archive.org/web/20221226100335/https://mercurial.selenic.com/wiki/WhatsNew\", \"URL-http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e\", \"URL-http://selenic.com/repo/hg-stable/rev/6dad422ecc5a\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Automatic\", \"Windows Powershell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:48.128325Z"}