RUSTSEC-2024-0355: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2024-0355) affects the gix-path Rust package version 0.10.8, discovered and disclosed in July 2024. The issue allows a limited user account to trick the package into running an arbitrary git.exe from an untrusted location when looking for Git for Windows installations (GitHub Advisory).

The vulnerability stems from gix-path's fallback strategy on Windows systems, where it checks two hard-coded paths intended for 64-bit and 32-bit Program Files directories. On 32-bit Windows systems, where C:\Program Files (x86) directory doesn't exist by default, a limited user can create this directory and populate it with arbitrary contents. The vulnerability has been assigned a CVSS score of 6.8 (Moderate) with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L (GitHub Advisory).

The vulnerability enables privilege escalation where a limited user can execute code as another user, including administrators. This is particularly impactful when Git for Windows is installed but not added to PATH, or when programs sanitize their PATH to remove seemingly nonessential directories. The vulnerability is comparable to CVE-2022-24765 but with simpler exploitation as it directly runs an executable rather than using configuration (GitHub Advisory).

Exploitation is primarily possible on 32-bit Windows systems and requires the attacker to have a user account on the system, though it can be a relatively unprivileged one. The vulnerability is exploitable when git cannot be found in a PATH search, particularly in configurations where Git for Windows is installed but not added to PATH. Running a 32-bit build on a 64-bit system is not a risk factor (GitHub Advisory).

The vulnerability has been patched in version 0.10.9 and later versions of gix-path. Users should upgrade to the patched version. As a workaround, ensuring that git is present in the system's PATH search can prevent exploitation (GitHub Advisory).