CVE-2024-53263

CVE-2024-53263 is a vulnerability found in Git Large File Storage (LFS), a Git extension used for managing large files within repositories. The vulnerability stems from how Git LFS handles URLs when requesting credentials. Specifically, it fails to check for embedded line-ending control characters (like line feed or carriage return) in the URLs passed to the `git-credential` command. This oversight allows attackers to craft malicious URLs containing these encoded control characters. When Git LFS subsequently sends credentials received from the helper back to the remote host, these manipulated URLs can enable an attacker to capture the user's Git credentials. Git LFS versions prior to v3.6.1 are susceptible to this vulnerability. Users are strongly encouraged to upgrade to the patched version (v3.6.1) to mitigate the risk of credential theft. Currently, there are no known workarounds for this vulnerability other than updating to the latest version. This vulnerability allows attackers to potentially gain unauthorized access to sensitive data and disrupt services that rely on Git LFS for file management.