CVE-2024-35186 gix traversal outside working tree enables arbitrary code execution
A path traversal flaw in the gix-worktree-state library allows attackers to write files outside the working tree during clone, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-35186?
CVE-2024-35186 is a high-severity path traversal vulnerability in Byron gitoxide, published on 23 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
Weakness: CWE-23
Which versions are affected by CVE-2024-35186?
17 open source packages ship an affected version, including gitoxide, gitoxide-core and gix.
| Package | Affected | Fixed in |
|---|---|---|
gitoxide crates.io | All versions | 0.36.0 |
gitoxide crates.io | All versions | 0.36.0 |
gitoxide-core crates.io | All versions | 0.38.0 |
gitoxide-core crates.io | All versions | 0.38.0 |
gix crates.io | All versions | 0.63.0 |
gix crates.io | All versions | 0.63.0 |
11 more packages
gix-fs crates.io | All versions | 0.11.0 |
gix-fs crates.io | All versions | 0.11.0 |
gix-fs crates.io | From 0.0.0-0 | 0.11.0 |
gix-index crates.io | All versions | 0.33.0 |
gix-index crates.io | All versions | 0.33.0 |
gix-index crates.io | From 0.0.0-0 | 0.33.0 |
gix-worktree crates.io | All versions | 0.34.0 |
gix-worktree crates.io | All versions | 0.34.0 |
gix-worktree crates.io | From 0.0.0-0 | 0.34.0 |
gix-worktree-state crates.io | All versions | 0.11.0 |
gix-worktree-state crates.io | All versions | 0.11.0 |
Linux distribution packages (1)
gitoxide openSUSE:Tumbleweed | All versions | 0.36.0-1.1 |
How do I fix CVE-2024-35186?
Upgrade gitoxide to 0.36.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-35186 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35186 exists.
Sources
Also known as DEBIAN-CVE-2024-35186, GHSA-7w47-3wg8-547c, RUSTSEC-2024-0348, RUSTSEC-2024-0349, RUSTSEC-2024-0350, UBUNTU-CVE-2024-35186 and 1 more.