Impact

Successful exploitation allows for the reading of sensitive git repository configurations, including embedded credentials, potentially impacting any software built on the affected versions of the gitoxide ecosystem. It bypasses established safe-directory security mechanisms, increasing the risk of unauthorized repository access or data exfiltration in development environments or CI/CD pipelines.

Recommendation

Update all projects using the gitoxide library to the patched versions immediately. Developers should audit usage of Submodule::open() and ensure that inputs from external .gitmodules files are sanitized before processing.

• Upgrade the gix crate to version 0.82.0 or later.
• Upgrade the gix-validate crate to version 0.11.1 or later.
• Audit repositories for unusually formatted entries in .gitmodules files, specifically those containing directory traversal sequences.

An attacker can exploit this by returning a malicious HTTP 3xx redirect with a crafted 'Location' header formatted as <attacker-authority>?@<original-authority>. The vulnerable identity guard incorrectly validates the target host, leading the client to reuse stored HTTP Basic Authorization credentials for the unintended attacker-controlled server. This flaw poses a high risk for any application leveraging gitoxide for Git operations that involve authenticating to remote repositories. Impacted users should update to gix-url 0.37.1 and gix-transport 0.58.1.

Attack Chain

1. Attacker hosts a malicious Git repository or HTTP server capable of serving custom HTTP 3xx redirect responses.
2. Victim initiates a Git operation (e.g., clone, fetch, or push) using a tool built with the vulnerable gitoxide crates.
3. Victim provides valid HTTP Basic Authorization credentials for the legitimate target repository.
4. Attacker returns an HTTP redirect response with a specially crafted 'Location' header: <attacker-authority>?@<original-authority>.
5. The gix-url parser processes the 'Location' header but fails to terminate the authority component at the '?' character.
6. The gix-transport identity guard compares the authority based on the flawed parsing and determines it is safe to reuse the existing credentials.
7. The client library automatically includes the Authorization header containing the victim's credentials in the subsequent request to the attacker-controlled authority.
8. Attacker logs the Authorization header, successfully capturing the victim's plaintext credentials.

Impact

Successful exploitation results in the unauthorized exposure of HTTP Basic Authorization credentials to an attacker. This potentially grants the attacker persistent access to the victim's private repositories or associated services, depending on the scope of the captured credentials. This affects any downstream software in the Rust ecosystem that integrates the gitoxide library for repository interaction.

Recommendation

1. Identify all applications and internal tooling within the organization that utilize the gitoxide Rust crates by auditing Cargo.lock files for gix-url and gix-transport.
2. Update gix-url to version 0.37.1 or higher and gix-transport to version 0.58.1 or higher to incorporate the corrected URL parsing logic.
3. For applications where immediate patching is not possible, implement strict allowlists for trusted host destinations to prevent redirects to unauthorized domains.
4. Perform log analysis on outbound HTTP requests from build servers and automated tooling to identify suspicious redirect responses involving unconventional URL formatting.

Impact

Successful exploitation allows an attacker to influence the configuration of Git submodules by injecting contents from arbitrary files on the victim's filesystem. This behavior could be leveraged to redirect submodule fetches to malicious servers or facilitate command execution depending on how the parsed metadata is consumed by the victim's environment. The vulnerability impacts any developer or automated build system utilizing versions of gitoxide below 0.52.1 to process untrusted repositories.

Recommendation

• Upgrade the gitoxide library to version 0.52.1 or higher across all development environments, CI/CD pipelines, and server-side infrastructure.
• Audit repositories processed by affected versions of gitoxide for unexpected symbolic links within the worktree, specifically targeting the '.gitmodules' file.
• Deploy environment-level restrictions to prevent user-space tools from traversing outside of known project directories if the environment regularly interacts with untrusted git repositories.