CVE-2024-32884 gix-transport indirect code execution via malicious username
Attackers can achieve arbitrary code execution by crafting a malicious Git clone URL that injects SSH options, requiring a specific local file setup.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32884?
CVE-2024-32884 is a medium-severity command injection vulnerability in Byron gitoxide, published on 26 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.
Which versions are affected by CVE-2024-32884?
7 open source packages ship an affected version, including gitoxide, gix and gix-transport.
| Package | Affected | Fixed in |
|---|---|---|
gitoxide crates.io | All versions | 0.35 |
gitoxide crates.io | All versions | 0.35 |
gix crates.io | All versions | 0.62 |
gix crates.io | All versions | 0.62 |
gix-transport crates.io | All versions | 0.42.0 |
gix-transport crates.io | All versions | 0.42.0 |
1 more packages
gix-transport crates.io | From 0.0.0-0 | 0.42.0 |
How do I fix CVE-2024-32884?
Upgrade gitoxide to 0.35 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-32884 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32884 exists.
Sources
Also known as AZL-40229, AZL-40264, GHSA-98p4-xjmm-8mfh, RUSTSEC-2024-0335.