gix-transport indirect code execution via malicious username

Summary

gix-transport does not check the username part of a URL for text that the external ssh program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs.

The first gix crate with the fix is version 0.62.0, and the first fixed gix CLI is version 0.35. gix-transport at version v0.42 is the lowest-level plumbing crate with the fix.

Details

This is related to the patched vulnerability RUSTSEC-2023-0064, but appears less severe due to a greater attack complexity. Since , gix-transport checks the host and path portions of a URL for text that has a - in a position that will cause ssh to interpret part of all of the URL as an option argument. But it does not check the non-mandatory username portion of the URL.

As in Git, when an address is a URL of the form ssh://username@hostname/path, or when it takes the special form username@hostname:dirs/repo, this is treated as an SSH URL. gix-transport will replace some characters in username with their %-based URL encodings, but otherwise passes username@hostname as an argument…