CVE-2024-45405

Medium · 6.0

CVSS

6.0

EPSS

0.3%

Published

Sep 6, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A path-handling mistake in a Rust Git library could let someone on the same computer run unwanted commands by placing oddly named files in certain folders.

Exploitation: Requires User Interaction
Attacker needs: Local User
Complexity: High
Impact: Full Compromise
Component: Library
Class: Path Traversal
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

The flaw causes gix-path to misparse quoted paths returned by 'git config -l --show-origin' when paths contain unusual or non-ASCII characters, allowing an attacker-controlled configuration file to be treated as the git installation config and enabling subsequent configuration injection that can lead to code execution.

Why it matters to the business

On developer or build systems using the affected crate, the issue could permit local code execution under uncommon configurations such as non-standard git installs or custom system-scope config paths, potentially compromising source code or build pipelines, though exploitation remains difficult and requires specific environmental conditions.

How an attack unfolds

A local attacker prepares a malicious configuration file containing settings that trigger code execution, ensures git outputs a quoted path due to special characters in the path, and manipulates environment variables or absence of higher-scope configs so that gix-path incorrectly resolves the path to the attacker's file; subsequent git operations then load the injected config.

How to fix it

Upgrade the gix-path dependency to version 0.10.11 or later (commit dea106a8c4fecc1f0a8f891a2691ad9c63964d25) and ensure git is installed in standard locations without special characters in path components.

How to confirm the fix worked

Confirm the resolved gix-path version is 0.10.11 or newer; test installation_config and installation_config_prefix functions with paths containing accented or non-ASCII characters to verify literal path handling.

Typical attack path

Craft a malicious git configuration file in a location whose path contains characters that git will quote
Set GIT_CONFIG_SYSTEM or similar variables to an unusual path or suppress system config
Trigger gix_path::env functions that invoke git config without --null
Cause the misparsed path to resolve to the attacker file
Execute git commands that consume the injected configuration to achieve code execution

How to detect it

Examine process execution logs and environment variables for unexpected git config invocations, review loaded configuration file paths for non-standard locations, and inspect for configuration settings that alter editor, hook, or credential behavior after gix-path usage.

What your security team should do

Update all dependents of gix-path to the patched version immediately
Audit git installations for non-standard paths containing special characters
Prefer standard system-wide git deployments and avoid custom GIT_CONFIG_SYSTEM settings where possible

The record

`gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their conversions. Prior to version 0.10.11, `gix-path` runs `git` to find the path of a configuration file associated with the `git` installation, but improperly resolves paths containing unusual or non-ASCII characters, in rare cases enabling a local attacker to inject configuration leading to code execution. Version 0.10.11 contains a patch for the issue. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` to find the path of a file to treat as belonging to the `git` installation. Affected versions of `gix-path` do not pass `-z`/`--null` to cause `git` to report literal paths. Instead, to cover the occasional case that `git` outputs a quoted path, they attempt to parse the path by stripping the quotation marks. The problem is that, when a path is quoted, it may change in substantial ways beyond the concatenation of quotation marks. If not reversed, these changes can result in another valid path that is not equivalent to the original. On a single-user system, it is not possible to exploit this, unless `GIT_CONFIG_SYSTEM` and `GIT_CONFIG_GLOBAL` have been set to unusual values or Git has been installed in an unusual way. Such a scenario is not expected. Exploitation is unlikely even on a multi-user system, though it is plausible in some uncommon configurations or use cases. In general, exploitation is more likely to succeed if users are expected to install `git` themselves, and are likely to do so in predictable locations; locations where `git` is installed, whether due to usernames in their paths or otherwise, contain characters that `git` quotes by default in paths, such as non-English letters and accented letters; a custom `system`-scope configuration file is specified with the `GIT_CONFIG_SYSTEM` environment variable, and its path is in an unusual location or has strangely named components; or a `system`-scope configuration file is absent, empty, or suppressed by means other than `GIT_CONFIG_NOSYSTEM`. Currently, `gix-path` can treat a `global`-scope configuration file as belonging to the installation if no higher scope configuration file is available. This increases the likelihood of exploitation even on a system where `git` is installed system-wide in an ordinary way. However, exploitation is expected to be very difficult even under any combination of those factors.

Affected packages

Ecosystem	Package	Introduced	Fixed
crates.io	gix-path	0	0.10.11
crates.io	gix-path	0.0.0-0	0.10.11
Chainguard	cargo-audit	0	0.21.2-r1
Chainguard	cargo-audit-doc	0	0.21.2-r1
Chainguard	cargo-c	0	0.10.4-r0
Chainguard	starship	0	1.20.1-r4
Debian:13	rust-gix-path	0	0.10.11-1
Ubuntu:24.04:LTS	rust-gix-path	0	No fix
Ubuntu:24.10	rust-gix-path	0	0.10.11-2
Wolfi	cargo-audit	0	0.21.2-r1
Wolfi	cargo-audit-doc	0	0.21.2-r1
Wolfi	cargo-c	0	0.10.4-r0
Wolfi	starship	0	1.20.1-r4
openSUSE:Leap 15.6	cargo-c	0	0.10.3~git0.ee7d7ef-150600.3.3.1
openSUSE:Tumbleweed	cargo-audit	0	0.20.0~git66.972ac93-3.1
openSUSE:Tumbleweed	cargo-c	0	0.10.3~git0.ee7d7ef-2.1
openSUSE:Tumbleweed	obs-service-cargo	0	1.3.6-5.1
openSUSE:Tumbleweed	onefetch	0	2.22.0-1.1
openSUSE:Tumbleweed	stgit	0	2.4.12-1.1