CVE-2024-35186 - CVE House
Back to Database
Status published High CVE-2024-35186

gix traversal outside working tree enables arbitrary code execution

Vulnerability Description

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-35186

Credits & Attribution

No credits recorded in the NVD database.

References

More from Byron

View All →
CVE-2024-45405
gix-path improperly resolves configuration path reported by Git
Medium 6
CVE-2024-45305
gix-path uses local config across repos when it is the highest scope
Low 2.5
CVE-2024-43785
gitoxide-core does not neutralize special characters for terminals
Low 2.5
CVE-2024-40644
gitoxide's gix-path can use a fake program files location
Medium 6.8
CVE-2024-35197
gix refs and paths with reserved Windows device names access the devices
Medium 5.4

Affected Vendor

Affected Software

gitoxide
Vulnerable Versions:
< 0.36.0

Timeline

Official Publish: May 23rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-23

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1105 Ingress Tool Transfer
Command and Control
T1565 Data Manipulation
Impact