GitHub Desktop RCE Exploit CVE-2020-27955




=============================================
- Discovered by: Dawid Golunski (@dawid_golunski)
- dawid[at]legalhackers.com
- https://legalhackers.com
- https://exploitbox.io

- CVE-2020-27955
- Release date: 04.11.2020
- Revision 1.0
- Severity: Critical
=============================================


VULNERABILITY
-------------------------

GitHub Desktop Remote Code Execution (RCE) CVE-2020-27955 (git-lfs)


BACKGROUND
-------------------------

GitHub Desktop

"Focus on what matters instead of fighting with Git. Whether you're new to Git or a seasoned user, 
GitHub Desktop simplifies your development workflow. "

https://desktop.github.com/



Video PoC
-------------------------




Advisories
-------------------------
Git RCE Expoit CVE-2020-27955 
Git-LFS RCE exploit CVE-2020-27955 



Exploits / PoC repos
-------------------------

Git / git-lfs - RCE exploit CVE-2020-27955 - GO version

GitHub - PoC repo - Git / git-lfs - RCE exploit CVE-2020-27955 - BAT/powershell version

GitHub - PoC repo - Git / git-lfs - RCE exploit CVE-2020-27955 - Go version