CVE-2017-1000117

CVE-2017-1000117 is a critical remote code execution vulnerability affecting Git (git_scm git) versions prior to 2.7.5. A malicious actor can craft a special "ssh://..." URL, which, when visited by an unsuspecting victim, can execute arbitrary programs on their machine. This can be triggered by tricking a user into running "git clone --recurse-submodules" on a malicious project containing the URL in its .gitmodules file. The vulnerability has a CVSS score of 8.8 (HIGH), indicating a severe risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. It requires user interaction to exploit, but the consequences are significant. While not officially listed on the KEV catalog, exploit modules are publicly available, including a Metasploit module. The vulnerability has garnered significant community discussion and media coverage, highlighting its widespread impact and the urgency of patching affected systems.