CVE-2024-32884 gix-transport indirect code execution via malicious username

2024-04-2618:04:04

CWE-77

CWE-88

GitHub_M

github.com

cve

gix-transport

code execution

gitoxide

vulnerability

patch

ssh

malicious file

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

AI Score

6.8

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

gitoxide is a pure Rust implementation of Git. gix-transport does not check the username part of a URL for text that the external ssh program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:byron:gitoxide:*:*:*:*:*:*:*:*"
    ],
    "vendor": "byron",
    "product": "gitoxide",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.35.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.62.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.42.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]