CVE-2024-32884 gix-transport indirect code execution via malicious username

2024-04-2618:04:04

CWE-77

CWE-88

GitHub_M

www.cve.org

code execution

malicious username

rust implementation

ssh options

patched vulnerability

attack complexity

version 0.35.0

version 0.42.0

version 0.62.0

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS

Percentile

9.0%

JSON

gitoxide is a pure Rust implementation of Git. gix-transport does not check the username part of a URL for text that the external ssh program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

CNA Affected

[
  {
    "vendor": "Byron",
    "product": "gitoxide",
    "versions": [
      {
        "version": "< 0.42.0",
        "status": "affected"
      },
      {
        "version": "< 0.62",
        "status": "affected"
      },
      {
        "version": "< 0.35",
        "status": "affected"
      }
    ]
  }
]