CVE-2024-32884 - CVE House
Back to Database
Status published Medium CVE-2024-32884

gix-transport indirect code execution via malicious username

Vulnerability Description

gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32884

Credits & Attribution

No credits recorded in the NVD database.

References

More from Byron

View All →
CVE-2024-45405
gix-path improperly resolves configuration path reported by Git
Medium 6
CVE-2024-45305
gix-path uses local config across repos when it is the highest scope
Low 2.5
CVE-2024-43785
gitoxide-core does not neutralize special characters for terminals
Low 2.5
CVE-2024-40644
gitoxide's gix-path can use a fake program files location
Medium 6.8
CVE-2024-35197
gix refs and paths with reserved Windows device names access the devices
Medium 5.4

Affected Vendor

Affected Software

gitoxide
Vulnerable Versions:
< 0.42.0, < 0.62, < 0.35

Timeline

Official Publish: April 26th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-77 CWE-88

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1105 Ingress Tool Transfer
Command and Control