GHSA-rrjw-j4m2-mf34: gix-transport code execution vulnerability

September 25, 2023 (updated July 8, 2024)

The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution.

PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'

This will launch a calculator on OSX.

See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.

Thanks for vin01 for disclosing this issue.

References

github.com/Byron/gitoxide
github.com/Byron/gitoxide/pull/1032
github.com/advisories/GHSA-rrjw-j4m2-mf34
rustsec.org/advisories/RUSTSEC-2023-0064.html
secure.phabricator.com/T12961

Detect and mitigate GHSA-rrjw-j4m2-mf34 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →