HTTP Basic Auth Credential Leak in gitoxide gix-transport

Executive Summary

The vulnerability is in gitoxide's gix-url crate versions <= 0.32.0 (fixed in 0.37.1) and gix-transport versions <= 0.49.0 (fixed in 0.58.1). It involves a flawed URL parser that does not properly handle '?' or '#' characters, allowing attackers to manipulate redirect responses. By crafting a malicious Location header, an attacker can trick the system into sending HTTP Basic Authorization credentials to an unintended host.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses vulnerable versions of gix-url (<=0.32.0) or gix-transport (<=0.49.0) by inspecting dependency files like Cargo.lock or running cargo tree. Monitor HTTP redirects in network traffic for malformed Location headers containing '?@' patterns that could indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use affected versions of gitoxide, an attacker could intercept and misuse your HTTP Basic Authorization credentials. This could lead to unauthorized access to sensitive data or systems, depending on the permissions associated with those credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, legal penalties, or reputational damage if credentials are compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Update gitoxide's gix-url crate to version 0.37.1 or later and gix-transport to version 0.58.1 or later to address the vulnerability.

Useful 0 Not Useful 0