gitoxidelabs/gitoxide · Security
gix-transport code execution vulnerability
- GHSA ID
- GHSA-rrjw-j4m2-mf34
- CVE ID
- CVE-2023-53158
- Severity
- medium
- Published
- Updated
- CVSS
- 4.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 4.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution.
PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'
This will launch a calculator on OSX.
See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.
Thanks for vin01 for disclosing this issue.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')