CVE-2022-24826 is a medium-severity vulnerability affecting Git Large File Storage (git-lfs) on Windows platforms. The issue arises from an untrusted search path weakness (CWE-426) in the way git-lfs executes external programs when operating within a malicious repository. Specifically, if git-lfs attempts to run an intended executable such as 'git.exe' or 'cygpath.exe' but cannot locate it in any directory listed in the system's PATH environment variable, it passes an empty string as the executable path to the Go 'os/exec' package. Due to a bug in this package on Windows, the empty string is interpreted as the current directory ('.') concatenated with a file extension from the PATHEXT environment variable, causing git-lfs to execute a file named '.' plus an extension (e.g., '..exe') found in the current working directory instead of the intended program. This allows an attacker who controls the repository to place malicious executables with names like '..exe' alongside similarly named files (e.g., 'git.exe') to achieve arbitrary code execution when git-lfs runs certain commands. The vulnerability does not affect Unix-based systems due to differences in path handling. Git-lfs versions from 2.12.1 up to but not including 3.1.3 are vulnerable. The issue was fixed in version 3.1.3 by changing git-lfs to report an error when the intended executable is not found in PATH, avoiding the empty string execution path. The underlying Go 'os/exec' package bug has been reported and is expected to be patched in future Go releases. There are currently no known workarounds other than upgrading. No exploits in the wild have been reported to date. This vulnerability requires that the attacker can supply a malicious repository and that the victim runs git-lfs commands on Windows with a PATH environment that does not include the intended executables, conditions that limit but do not eliminate risk.

For European organizations, this vulnerability poses a risk primarily to Windows-based development environments or CI/CD pipelines that use git-lfs to manage large files in Git repositories. If an attacker can convince a developer or automated system to clone or operate on a malicious repository containing specially crafted files, they could execute arbitrary code with the privileges of the user running git-lfs. This could lead to compromise of developer workstations, injection of malicious code into software builds, or lateral movement within internal networks. The impact on confidentiality, integrity, and availability depends on the attacker's objectives but could include theft of sensitive source code, insertion of backdoors, or disruption of development processes. Since exploitation requires the absence of the intended executables in PATH, environments with misconfigured or minimal PATH variables are at higher risk. The lack of known exploits in the wild and the requirement for user interaction reduce immediate risk, but the vulnerability remains significant for organizations relying heavily on git-lfs in Windows environments. European organizations with large software development operations, especially those in critical infrastructure, finance, or technology sectors, should prioritize remediation to prevent potential supply chain or insider threats.

The primary mitigation is to upgrade all git-lfs installations on Windows to version 3.1.3 or later, which contains the fix for this vulnerability. Additionally, organizations should audit and enforce proper PATH environment configurations to ensure that essential executables like 'git.exe' and 'cygpath.exe' are always resolvable and present in PATH during git-lfs operations. Implement strict repository validation and scanning to detect and block repositories containing suspicious files with names like '..exe' or other unusual extensions that could exploit this vulnerability. Employ endpoint protection solutions that can detect and prevent execution of unauthorized binaries in developer environments. Integrate security awareness training for developers to recognize and avoid cloning or operating on untrusted or suspicious repositories. For CI/CD pipelines, run git-lfs commands in isolated or containerized environments with controlled PATH variables and limited privileges to reduce the impact of potential exploitation. Monitor logs for unusual git-lfs execution behaviors or errors indicating missing executables in PATH, which could signal attempted exploitation. Finally, track updates to the Go runtime to apply patches addressing the underlying os/exec package bug once available.