CyberRota Analysis
AI-GeneratedVersions of gitoxide from 0.25.4 are vulnerable to an HTTP credential leak, where authentication tokens may be exposed to attacker-controlled servers due to improper validation of URLs during redirects. This flaw enables attackers to exploit cross-domain redirects or downgrade HTTPS connections to HTTP, potentially compromising sensitive credentials. Organizations using affected versions should prioritize remediation to protect against unauthorized access and credential theft.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.