PT-2024-5164 · Gitoxide · Gitoxide
Eliahkagan
·
Published
2024-04-13
·
Updated
2025-07-29
·
CVE-2024-32884
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
gitoxide versions prior to 0.35.0
gitoxide versions prior to 0.42.0
gitoxide versions prior to 0.62.0
Description:
The issue is related to the
gix-transport component of gitoxide, which does not properly check the username part of a URL for text that the external ssh program would interpret as an option. This allows a specially crafted clone URL to smuggle options to SSH, potentially leading to arbitrary code execution if a malicious clone URL is used by an application whose current working directory contains a malicious file. The possibilities for exploitation are syntactically limited, but an attacker who can cause a specially named ssh configuration file to be placed in the current working directory can smuggle in an -F option referencing the file, allowing arbitrary command execution. This scenario is especially plausible because programs that operate on git repositories are often run in untrusted git repositories.Recommendations:
To resolve the issue for versions prior to 0.35.0, update to version 0.35.0 or later.
To resolve the issue for versions prior to 0.42.0, update to version 0.42.0 or later.
To resolve the issue for versions prior to 0.62.0, update to version 0.62.0 or later.
As a temporary workaround, consider restricting access to the
gix-transport component until a patch is available.
Avoid using the gix clone command with untrusted URLs, especially in scenarios where the current working directory may contain malicious files.Exploit
Fix
Improper Neutralization
Special Elements Injection
Argument Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gitoxide