Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.

A vulnerability in Git for Windows prior to version 2.55.0.windows.4 allows a malicious remote Git server to advertise a crafted bundle URI that triggers an outbound SMB connection from the victim's Windows machine. The flaw exists in bundle-uri.c, specifically in the functions transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). When transfer.bundleuri=true, non-HTTP(S) URIs are treated as local filesystem paths, allowing UNC paths or file URIs to be processed without proper validation. This causes Windows to initiate an SMB connection to an attacker-controlled host, exposing NTLM authentication credentials. The attack can be triggered during a git clone or fetch operation. The issue is resolved in Git for Windows version 2.55.0.windows.4.