Git Submodule Vulnerability (CVE-2024-32002): Case-Insensitive RCE and How to Patch Repositories

Understanding the Case-Insensitive Filesystem Exploit

In May 2024, the Git project disclosed CVE-2024-32002, a critical remote code execution vulnerability (CVSS 9.8). The flaw specifically exploits operating systems with case-insensitive but case-preserving filesystems, such as Windows (NTFS) and macOS (APFS). When cloning a repository with submodules recursively (git clone --recursive), Git could be fooled into writing a malicious hook script into the parent repository's .git/hooks/ directory.

How the Attack Works

1. The attacker creates a repository with a submodule pointing to a path like .git/modules/submodule_path using crafted casing variations (e.g. .Git/modules/...).
2. Git creates a symlink pointing to the .git/ directory.
3. During recursive checkout, Git writes the submodule's files into the symlinked path, dropping an executable post-checkout hook into the target repository's .git/hooks/ folder.
4. The hook executes immediately during the clone operation with the user's full privileges.

Mandatory Action for Engineering Teams

Update Git across all developer laptops, servers, and CI runners to version 2.45.1, 2.44.1, 2.43.4, 2.42.2, or 2.41.1 immediately. Disable recursive cloning of untrusted third-party repositories.