CVE-2024-32884: 
Rust vulnerability analysis and mitigation

gitoxide is a pure Rust implementation of Git that contains a vulnerability in its gix-transport component (CVE-2024-32884). The vulnerability allows attackers to smuggle SSH options through specially crafted clone URLs due to insufficient validation of the username part of URLs. This security flaw was discovered and disclosed in April 2024, affecting versions prior to 0.35.0, 0.42.0, and 0.62.0 (GitHub Advisory, RustSec Advisory).

The vulnerability stems from gix-transport's failure to check the username portion of URLs for text that could be interpreted as SSH program options. While the component checks host and path portions for potentially dangerous characters, it overlooks the non-mandatory username section. When processing SSH URLs in the format ssh://username@hostname/path or username@hostname:dirs/repo, the system performs URL encoding on some characters in the username but still passes the username@hostname combination as an argument to the external SSH command. If the username begins with a hyphen, SSH interprets it as an option argument, potentially leading to security issues. The vulnerability has been assigned a CVSS v3.1 score of 6.4 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L (GitHub Advisory).

The vulnerability can lead to arbitrary code execution if a malicious clone URL is used by an application whose current working directory contains a malicious file. The impact is particularly significant in scenarios involving repositories with automatically added submodules, operations on other repositories from within an untrusted repository, or when reviewing contributions from untrusted developers by checking out branches from untrusted forks (GitHub Advisory).

Exploitation requires user interaction to trigger a clone or connection attempt using the malicious URL. The attack is constrained by several factors, including the difficulty of forming valid SSH option arguments due to URL encoding of special characters, the inability to include literal '=' signs (preventing -oNAME=VALUE usage), and the inability to include literal '/' or '' characters. However, an attacker can achieve code execution by placing a specially named SSH configuration file in the current working directory and smuggling in an -F option referencing that file (GitHub Advisory, RustSec Advisory).

The vulnerability has been patched in multiple versions: gitoxide v0.35.0, gix v0.62.0, and gix-transport v0.42.0. Users are strongly advised to upgrade to these or later versions to mitigate the security risk (GitHub Advisory).