8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-m4f9-c775-wg56

GHSA-m4f9-c775-wg56: Duplicate Advisory: gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-f26g-jm89-4g65. This link is maintained to preserve external references.

Original Description

gix-submodule before 0.82.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-m4f9-c775-wg56

GHSA-m4f9-c775-wg56:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gix	rust	>= 0.31.0, < 0.83.0	0.83.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection in gitoxide's submodule handling. An attacker can craft a malicious .gitmodules file with a command in the update field (e.g., update = !/path/to/malicious/script). When a user runs a submodule update operation, this command would be executed. The vulnerability lies in the insufficient validation of the origin of the update configuration.

The provided patch addresses this by introducing a new, more robust abstraction for handling .gitmodules files. The analysis of the patch identified two key functions:

gix_submodule::config::Update::try_from: This function is responsible for parsing the raw string value of the update field. It identifies values starting with ! as commands and wraps them in the Update::Command enum variant. This is the first step in processing the malicious input.
gix_submodule::File::update: This function retrieves the parsed Update value and, crucially, performs a security check. It verifies that if the value is a Update::Command, it must not originate from the .gitmodules file itself. It does this by checking if the configuration section comes from a 'foreign' source (like the user's local .git/config), which is considered a trusted override. If the command is in .gitmodules, it returns a CommandForbiddenInModulesConfiguration error, preventing the command from being executed.

By identifying these two functions, we can pinpoint the exact locations in the code that process the malicious input and where the security mitigation is applied. During an exploit attempt on a vulnerable version, a function similar in purpose to gix_submodule::File::update would be present in the stack trace, but it would lack the correct validation logic.

Vulnerable functions

gix_submodule::File::update

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.