{"answers":{"affected":"3 open source packages ship an affected version, including gix-path.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-40644 exists.","fix":"Upgrade gix-path to 0.10.9 or later.","what":"CVE-2024-40644 is a medium-severity path traversal vulnerability in Byron gitoxide, published on 18 Jul 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-40644 and fix it if it is affected.\n\nWhat it is: CVE-2024-40644 is a medium-severity path traversal vulnerability in Byron gitoxide, published on 18 Jul 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-40644 exists.\n\nAffected packages and fixed versions:\n- gix-path (crates.io): affected from 0.10.8; fixed in 0.10.9\n- gix-path (crates.io): affected from 0.10.8; fixed in 0.10.9\n- gix-path (crates.io): affected from 0.10.8; fixed in 0.10.9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-40644/ (Markdown: https://insights.sbomify.com/CVE-2024-40644/index.md)","id":"CVE-2024-40644","markdown":"https://insights.sbomify.com/CVE-2024-40644/index.md","name":"CVE-2024-40644","record":{"aliases":["GHSA-mgvv-9p9g-3jv4","RUSTSEC-2024-0355"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Rust Git library","requires_auth":"low_privilege","summary":"Attackers can execute arbitrary code by placing a malicious git.exe in a predictable directory on 32-bit Windows systems, affecting users of the gix-path library.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.8,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"description":"gitoxide An idiomatic, lean, fast \u0026 safe pure Rust implementation of Git. `gix-path` can be tricked into running another `git.exe` placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new directories in the root of the system drive. While `gix-path` first looks for `git` using a `PATH` search, in version 0.10.8 it also has a fallback strategy on Windows of checking two hard-coded paths intended to be the 64-bit and 32-bit Program Files directories. Existing functions, as well as the newly introduced `exe_invocation` function, were updated to make use of these alternative locations. This causes facilities in `gix_path::env` to directly execute `git.exe` in those locations, as well as to return its path or whatever configuration it reports to callers who rely on it. Although unusual setups where the system drive is not `C:`, or even where Program Files directories have non-default names, are technically possible, the main problem arises on a 32-bit Windows system. Such a system has no `C:\\Program Files (x86)` directory. A limited user on a 32-bit Windows system can therefore create the `C:\\Program Files (x86)` directory and populate it with arbitrary contents. Once a payload has been placed at the second of the two hard-coded paths in this way, other user accounts including administrators will execute it if they run an application that uses `gix-path` and do not have `git` in a `PATH` directory. (While having `git` found in a `PATH` search prevents exploitation, merely having it installed in the default location under the real `C:\\Program Files` directory does not. This is because the first hard-coded path's `mingw64` component assumes a 64-bit installation.). Only Windows is affected. Exploitation is unlikely except on a 32-bit system. In particular, running a 32-bit build on a 64-bit system is not a risk factor. Furthermore, the attacker must have a user account on the system, though it may be a relatively unprivileged account. Such a user can perform privilege escalation and execute code as another user, though it may be difficult to do so reliably because the targeted user account must run an application or service that uses `gix-path` and must not have `git` in its `PATH`. The main exploitable configuration is one where Git for Windows has been installed but not added to `PATH`. This is one of the options in its installer, though not the default option. Alternatively, an affected program that sanitizes its `PATH` to remove seemingly nonessential directories could allow exploitation. But for the most part, if the target user has configured a `PATH` in which the real `git.exe` can be found, then this cannot be exploited. This issue has been addressed in release version 0.10.9 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"gitoxide's gix-path can use a fake program files location","id":"CVE-2024-40644","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"path_traversal","year":"2024"},"n_packages":3,"n_references":3,"next":{"headline":"FOG Authenticated File Upload RCE","id":"CVE-2024-40645"},"packages":[{"ecosystem":"crates.io","fixed":["0.10.9"],"introduced":["0.10.8"],"last_affected":[],"package":"gix-path","purl":null,"source":"GHSA-mgvv-9p9g-3jv4"},{"ecosystem":"crates.io","fixed":["0.10.9"],"introduced":["0.10.8"],"last_affected":[],"package":"gix-path","purl":"pkg:cargo/gix-path","source":"GHSA-mgvv-9p9g-3jv4"},{"ecosystem":"crates.io","fixed":["0.10.9"],"introduced":["0.10.8"],"last_affected":[],"package":"gix-path","purl":"pkg:cargo/gix-path","source":"RUSTSEC-2024-0355"}],"prev":{"headline":"Joplin has a parsing error leading to Cross-site Scripting (XSS)","id":"CVE-2024-40643"},"products":["gitoxide"],"published":"2024-07-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["Byron"]},"summary":"Attackers can execute arbitrary code by placing a malicious git.exe in a predictable directory on 32-bit Windows systems, affecting users of the gix-path library.","url":"https://insights.sbomify.com/CVE-2024-40644/"}