Reported

September 23, 2023

Issued

September 25, 2023 (last modified: February 10, 2024)

Package

gix-transport (crates.io)

Type

Vulnerability

Categories

• code-execution

Aliases

• GHSA-rrjw-j4m2-mf34

References

• https://github.com/Byron/gitoxide/pull/1032
• https://secure.phabricator.com/T12961

Patched

• >=0.36.1

Description

The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution.

PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'

This will launch a calculator on OSX.

See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.

Thanks for vin01 for disclosing the issue.

Advisory available under CC0-1.0 license.