Executive Summary

This vulnerability exists in Cargo versions between 1.68 and 1.96, where the software incorrectly normalizes URLs of third-party registries using the sparse index protocol.

If a hosting provider allows multiple registries with arbitrary names under the same domain, an attacker who can publish crates in one registry could potentially obtain the credentials of other users of that same registry.

The vulnerability is considered low severity due to the very specific and niche conditions required to exploit it.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker who has publishing rights in a registry to steal credentials of other users within that registry.

This could lead to unauthorized access to user accounts or resources associated with those credentials.

However, the impact is limited by the low severity rating and the very specific conditions needed to carry out the attack.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker who can publish crates in a registry to obtain the credentials of other users of the same registry under certain niche conditions.

Such unauthorized credential access could potentially lead to unauthorized data access or disclosure, which may impact compliance with data protection regulations like GDPR or HIPAA if sensitive personal or health information is involved.

However, the severity of the vulnerability is rated as low due to the extremely niche requirements needed to achieve the attack, which may limit its practical impact on compliance.

Useful 0 Not Useful 0