CVE-2024-40644

{"id": "CVE-2024-40644", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 1.3}]}, "published": "2024-07-18T17:15:04.850", "references": [{"url": "https://github.com/Byron/gitoxide/blob/6cd8b4665bb7582f744c3244abaef812be39ec35/gix-path/src/env/git.rs#L9-L14", "source": "security-advisories@github.com"}, {"url": "https://github.com/Byron/gitoxide/commit/15235bf7968042da0493d431bbc955d6f9f54188", "source": "security-advisories@github.com"}, {"url": "https://github.com/Byron/gitoxide/security/advisories/GHSA-mgvv-9p9g-3jv4", "source": "security-advisories@github.com"}, {"url": "https://github.com/Byron/gitoxide/blob/6cd8b4665bb7582f744c3244abaef812be39ec35/gix-path/src/env/git.rs#L9-L14", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Byron/gitoxide/commit/15235bf7968042da0493d431bbc955d6f9f54188", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Byron/gitoxide/security/advisories/GHSA-mgvv-9p9g-3jv4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. `gix-path` can be tricked into running another `git.exe` placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new directories in the root of the system drive. While `gix-path` first looks for `git` using a `PATH` search, in version 0.10.8 it also has a fallback strategy on Windows of checking two hard-coded paths intended to be the 64-bit and 32-bit Program Files directories. Existing functions, as well as the newly introduced `exe_invocation` function, were updated to make use of these alternative locations. This causes facilities in `gix_path::env` to directly execute `git.exe` in those locations, as well as to return its path or whatever configuration it reports to callers who rely on it. Although unusual setups where the system drive is not `C:`, or even where Program Files directories have non-default names, are technically possible, the main problem arises on a 32-bit Windows system. Such a system has no `C:\\Program Files (x86)` directory. A limited user on a 32-bit Windows system can therefore create the `C:\\Program Files (x86)` directory and populate it with arbitrary contents. Once a payload has been placed at the second of the two hard-coded paths in this way, other user accounts including administrators will execute it if they run an application that uses `gix-path` and do not have `git` in a `PATH` directory. (While having `git` found in a `PATH` search prevents exploitation, merely having it installed in the default location under the real `C:\\Program Files` directory does not. This is because the first hard-coded path's `mingw64` component assumes a 64-bit installation.). Only Windows is affected. Exploitation is unlikely except on a 32-bit system. In particular, running a 32-bit build on a 64-bit system is not a risk factor. Furthermore, the attacker must have a user account on the system, though it may be a relatively unprivileged account. Such a user can perform privilege escalation and execute code as another user, though it may be difficult to do so reliably because the targeted user account must run an application or service that uses `gix-path` and must not have `git` in its `PATH`. The main exploitable configuration is one where Git for Windows has been installed but not added to `PATH`. This is one of the options in its installer, though not the default option. Alternatively, an affected program that sanitizes its `PATH` to remove seemingly nonessential directories could allow exploitation. But for the most part, if the target user has configured a `PATH` in which the real `git.exe` can be found, then this cannot be exploited. This issue has been addressed in release version 0.10.9 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "gitoxide Una implementaci\u00f3n Rust pura idiom\u00e1tica, sencilla, r\u00e1pida y segura de Git. Se puede enga\u00f1ar a `gix-path` para que ejecute otro `git.exe` colocado en una ubicaci\u00f3n que no es de confianza mediante una cuenta de usuario limitada en sistemas Windows. Windows permite cuentas de usuario limitadas sin privilegios administrativos para crear nuevos directorios en la ra\u00edz de la unidad del sistema. Mientras que `gix-path` primero busca `git` usando una b\u00fasqueda `PATH`, en la versi\u00f3n 0.10.8 tambi\u00e9n tiene una estrategia alternativa en Windows para verificar dos rutas codificadas destinadas a ser de 64 bits y 32 bits. Directorios de archivos de programa. Las funciones existentes, as\u00ed como la funci\u00f3n `exe_invocation` recientemente introducida, se actualizaron para hacer uso de estas ubicaciones alternativas. Esto hace que las funciones en `gix_path::env` ejecuten directamente `git.exe` en esas ubicaciones, as\u00ed como que devuelvan su ruta o cualquier configuraci\u00f3n que informe a las personas que llaman y dependen de ella. Aunque t\u00e9cnicamente son posibles configuraciones inusuales donde la unidad del sistema no es `C:`, o incluso donde los directorios de Archivos de programa tienen nombres no predeterminados, el problema principal surge en un sistema Windows de 32 bits. Un sistema de este tipo no tiene el directorio `C:\\Program Files (x86)`. Por lo tanto, un usuario limitado en un sistema Windows de 32 bits puede crear el directorio `C:\\Program Files (x86)` y llenarlo con contenidos arbitrarios. Una vez que se ha colocado una carga \u00fatil en la segunda de las dos rutas codificadas de esta manera, otras cuentas de usuario, incluidos los administradores, la ejecutar\u00e1n si ejecutan una aplicaci\u00f3n que usa `gix-path` y no tienen `git` en un directorio `PATH`. (Aunque encontrar `git` en una b\u00fasqueda `PATH` previene la explotaci\u00f3n, simplemente tenerlo instalado en la ubicaci\u00f3n predeterminada en el directorio real `C:\\Program Files` no lo hace. Esto se debe a que `mingw64` de la primera ruta codificada componente asume una instalaci\u00f3n de 64 bits). S\u00f3lo Windows se ve afectado. La explotaci\u00f3n es poco probable excepto en un sistema de 32 bits. En particular, ejecutar una versi\u00f3n de 32 bits en un sistema de 64 bits no es un factor de riesgo. Adem\u00e1s, el atacante debe tener una cuenta de usuario en el sistema, aunque puede ser una cuenta relativamente sin privilegios. Dicho usuario puede realizar una escalada de privilegios y ejecutar c\u00f3digo como otro usuario, aunque puede resultar dif\u00edcil hacerlo de manera confiable porque la cuenta de usuario objetivo debe ejecutar una aplicaci\u00f3n o servicio que use `gix-path` y no debe tener `git` en su `RUTA`. La principal configuraci\u00f3n explotable es aquella en la que se instal\u00f3 Git para Windows pero no se agreg\u00f3 a \"PATH\". Esta es una de las opciones de su instalador, aunque no es la opci\u00f3n predeterminada. Alternativamente, un programa afectado que desinfecte su `PATH` para eliminar directorios aparentemente no esenciales podr\u00eda permitir la explotaci\u00f3n. Pero en su mayor `PATH`, si el usuario objetivo ha configurado una `PATH` en la que se puede encontrar el \"git.exe\" real, entonces esto no se puede explotar. Este problema se solucion\u00f3 en la versi\u00f3n 0.10.9 y se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-11-21T09:31:25.317", "sourceIdentifier": "security-advisories@github.com"}