Executive Risk Summary
"A vulnerability in Git Credential Manager (GCM) allows an attacker to capture credentials for another Git remote by crafting a malicious remote URL, potentially leading to unauthorized access. The issue is patched in version 2.6.1, and users are advised to upgrade or only interact with trusted remote repositories."
Operational Audit Arsenal
Target Type Executable
Target Asset git-credential-manager.exe
Standard Path %PROGRAMFILES%\Git\mingw64\libexec\git-core\git-credential-manager.exe
PowerShell
# 🛠️ Senior Engineer Universal Audit
# Target: git-credential-manager.exe (Executable)
$Targets = 'git-credential-manager.exe'
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")
Get-ChildItem -Path $SearchPaths -Include $Targets -Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}Patch Impact Forecast
Reboot Required Unlikely
Git operations may be affected during the upgrade process
Internal Work Notes
CVE-2024-50338: Git Credential Manager vulnerability allowing credential capture, patched in version 2.6.1
Technical Intelligence & Operational Utilities • Delivered Weekly
Intelligence Sources
Official Advisoryhttps://git-scm.com/docs/git-credential#IOFMT
Official Advisoryhttps://github.com/dotnet/runtime/blob/e476b43b5cb42eb44ce23b1c7b793aa361624cf6/src/libraries/System.Private.CoreLib/src/System/IO/StreamReader.cs#L926
Official Advisoryhttps://github.com/git-ecosystem/git-credential-manager/blob/ae009e11a0fbef804ad9f78816d84a0bc7e052fe/src/shared/Core/StreamExtensions.cs#L138-L141
Official Advisoryhttps://github.com/git-ecosystem/git-credential-manager/compare/749e287571c78a2b61f926ccce6a707050871ab8...99e2f7f60e7364fe807e7925f361a81f3c47bd1b
Official Advisoryhttps://github.com/git-ecosystem/git-credential-manager/releases/tag/v2.6.1
Official Advisoryhttps://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g
Official Advisoryhttps://github.com/git/git/blob/6a11438f43469f3815f2f0fc997bd45792ff04c0/credential.c#L311
MSRC Advisoryhttps://learn.microsoft.com/en-us/dotnet/api/system.io.streamreader?view=net-8.0
Related Microsoft Threats
Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.