Cloudanix VulnDB

CVE-2024-45305

Low · 2.5

CVSS

2.5

EPSS

0.2%

Published

Sep 2, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A git helper library could accidentally read settings from an untrusted folder instead of the computer's main settings, potentially sending login details to the wrong place.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The gix-path crate parses output from `git config -l --show-origin` and incorrectly selects a local repository configuration file as the system-wide installation config when no higher-scoped config is present, causing configuration variables and credentials from a less-trusted source to be used in place of trusted system settings.

Why it matters to the business

Organizations using affected gitoxide components risk unintended leakage of repository credentials to incorrect remotes or application of untrusted configuration, which can disrupt development workflows or expose sensitive data across multiple repositories.

How an attack unfolds

An attacker prepares a repository whose local configuration becomes the highest-scoped result returned by the git invocation; when gix-path processes this output it promotes the local config to system scope, allowing the malicious repository to supply credentials or settings that are then applied to operations involving other repositories.

How to fix it

Upgrade the gitoxide crate to a version containing commit 4000197ecc8cf1a5d79361620e4c114f86476703 (corresponding to gix-path 0.10.10) or later; rebuild and redeploy all dependent binaries.

How to confirm the fix worked

Confirm the installed gix-path version is at least 0.10.10 by inspecting Cargo.lock or running cargo tree; re-execute git config -l --show-origin in test environments and verify that only files from expected system/global scopes are returned by the library functions.

Typical attack path

  1. Place a crafted local git configuration in a repository under attacker control
  2. Ensure no higher-scoped system or global configuration exists in the environment
  3. Trigger code paths that invoke gix_path::env::installation_config or installation_config_prefix
  4. Observe that the local repository's configuration values (including credential helpers or remotes) are treated as system-wide

How to detect it

Review process execution logs for invocations of git config -l --show-origin originating from gitoxide binaries; inspect application logs for unexpected configuration file paths originating from repository-local .git directories being treated as system configuration.

What your security team should do

  • Prioritize upgrade of gitoxide-based tooling in CI/CD and developer environments within the next sprint
  • Audit any custom code that calls gix_path::env functions for direct use of installation_config results
  • Monitor upstream gitoxide releases for related path-handling changes

The record

gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope. It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected. This issue has been addressed in release version 0.10.10. All users are advised to upgrade.

Affected packages

Ecosystem Package Introduced Fixed
crates.io gix-path 0 0.10.10
crates.io gix-path 0.0.0-0 0.10.10
Chainguard cargo-audit 0 0.21.2-r1
Chainguard cargo-audit-doc 0 0.21.2-r1
Chainguard cargo-c 0 0.10.4-r0
Chainguard starship 0 1.22.1-r0
Debian:13 rust-gix-path 0 0.10.11-1
Ubuntu:24.04:LTS rust-gix-path 0 No fix
Ubuntu:24.10 rust-gix-path 0 0.10.11-2
Wolfi cargo-audit 0 0.21.2-r1
Wolfi cargo-audit-doc 0 0.21.2-r1
Wolfi cargo-c 0 0.10.4-r0
Wolfi starship 0 1.22.1-r0

Related vulnerabilities