A vulnerability in Git for Windows allows unauthenticated remote attackers to capture NTLM hashes, posing a significant risk of credential theft and subsequent unauthorized system access.

This is an exposure of sensitive information (CWE-200) where the software fails to prevent unauthorized actors from triggering an NTLM authentication request. An unauthenticated attacker can force a victim's machine to authenticate against an attacker-controlled server simply by inducing the user to interact with a malicious repository or branch.

Successful exploitation leads to the exposure of NTLMv2 hashes, which can be brute-forced or relayed to gain unauthorized access to internal systems and sensitive data. With a CVSS score of 7.4, this vulnerability represents a high risk to organizational security, as it facilitates lateral movement and credential harvesting within an enterprise network.

Immediate Action: Upgrade all installations of Git for Windows to version 2.53.0.windows.3 or later to apply the necessary security protections.

Proactive Monitoring: Monitor network egress traffic for unusual SMB or authentication-related requests originating from developer workstations to unauthorized external IP addresses.

Compensating Controls: Implement organizational policies to restrict NTLM authentication and encourage the use of more secure protocols like Kerberos or certificate-based authentication where possible.

Public Exploit Available: Unknown

Given the ease with which an attacker can harvest credentials, this vulnerability should be prioritized for remediation across all developer environments. Security teams must ensure that the update to version 2.53.0.windows.3 is deployed immediately to eliminate the risk of NTLM hash exposure and protect the integrity of organizational credentials.