CyberRota Analysis
AI-GeneratedThe gix-url crate in gitoxide versions up to 0.32.0 is vulnerable due to a flawed URL parser that improperly handles '?' and '#' characters, allowing attackers to manipulate HTTP redirects. This flaw can lead to unauthorized exposure of HTTP Basic Authorization credentials to unintended hosts, posing a significant security risk. Organizations using affected versions of gix-transport (up to 0.49.0) should prioritize updating to version 0.58.1 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).