gix traversal außerhalb des Arbeitsbaums ermöglicht beliebige Codeausführung

The core of this vulnerability lies in gitoxide's insufficient path validation during checkout operations. When cloning a repository, the application doesn't adequately verify that the paths within the repository point to locations within the intended working tree. An attacker can leverage this by crafting a repository containing specially named tree or blob objects. Upon cloning, gitoxide will attempt to create files based on these names, potentially writing them to any location writable by the application process. This could include overwriting critical system files, injecting malicious code, or gaining unauthorized access to sensitive data. The blast radius extends beyond the repository itself, potentially impacting the entire system if the application runs with elevated privileges.

Developers and systems administrators who use gitoxide in their workflows are at risk. This includes those involved in CI/CD pipelines, automated build processes, and any environment where Git repositories are cloned from untrusted sources. Shared hosting environments where multiple users have write access to the same Git repository are particularly vulnerable.

• linux / server:

find /path/to/git/working/directory -type f -not -path "*/.git/*" -printf '%f\n' | sort | uniq -c | sort -nr | head -10

This command searches for the 10 most frequently created files in the Git working directory, which could indicate malicious file creation. • windows / supply-chain:

Get-ChildItem -Path $env:TEMP -Recurse -File | Sort-Object LastWriteTime -Descending | Select-Object -First 10

This PowerShell command lists the 10 most recently modified files in the temporary directory, which could reveal suspicious file activity. • generic web:

curl -I <gitoxide_repository_url> | grep 'Content-Type:'

Inspect the Content-Type header of the Git repository URL to ensure it's a valid Git repository and not attempting to serve malicious content.

1. 2024-05-22Disclosure

   disclosure

1. Reserviert2024-05-10
2. Veröffentlicht2024-05-22
3. Geändert2026-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-35186 is to immediately upgrade to gitoxide version 0.11.0 or later. This version includes the necessary path validation checks to prevent arbitrary file writes. If upgrading is not immediately feasible, consider implementing stricter file system permissions to limit the application's write access. While a WAF or proxy cannot directly prevent this vulnerability, they can be configured to monitor for unusual file creation patterns or suspicious file names. There are no known specific Sigma or YARA rules for this vulnerability, but monitoring for unexpected file creation events within the gitoxide working directory is recommended. After upgrading, confirm the fix by attempting to clone a known malicious repository (if available) and verifying that files are not created outside the intended repository directory.