4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5c5j-jmhx-q2gr

GHSA-5c5j-jmhx-q2gr: Duplicate Advisory: gix-transport code execution vulnerability

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rrjw-j4m2-mf34. This link is maintained to preserve external references.

Original Description

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5c5j-jmhx-q2gr

GHSA-5c5j-jmhx-q2gr:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gix-transport	rust	< 0.36.1	0.36.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the gix-transport crate, where parts of a user-provided URL, specifically the host and path, were used to construct shell commands without proper sanitization. An attacker could craft a URL with a host or path beginning with a hyphen (-), causing the subsequent ssh or git command to interpret it as a command-line option instead of a positional argument. This allows for OS command injection.

The analysis of the fixing commits reveals the exact locations where this vulnerability was addressed. The core of the fix was the introduction of Url::host_argument_safe() and Url::path_argument_safe() methods, which check if the respective URL components look like command-line arguments.

The key vulnerable functions identified are:

gix_transport::client::blocking_io::ssh::connect: Directly used url.host() to build an ssh command, which was patched to use url.host_argument_safe().
gix_transport::client::blocking_io::ssh::program_kind::ProgramKind::prepare_and_get_raw_command: Constructed ssh command arguments using the raw host from the URL. This was also patched to use the safe version of the host getter.
gix_transport::client::blocking_io::file::SpawnProcessOnDemand::invoke: Used the repository path when spawning a process, which could be malicious. The patch added a direct check to ensure the path does not start with a hyphen.

These functions are directly involved in processing the malicious URL and constructing the vulnerable command, making them the primary indicators that would appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.