CVE-2024-32884: gix-transport indirect code execution via malicious username

April 15, 2024 (updated July 5, 2024)

gix-transport does not check the username part of a URL for text that the external ssh program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs.

References

github.com/Byron/gitoxide
github.com/Byron/gitoxide/security/advisories/GHSA-98p4-xjmm-8mfh
github.com/advisories/GHSA-98p4-xjmm-8mfh
nvd.nist.gov/vuln/detail/CVE-2024-32884
rustsec.org/advisories/RUSTSEC-2024-0335.html

Code Behaviors & Features

Detect and mitigate CVE-2024-32884 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →