CyberRota Analysis
AI-GeneratedThe vulnerability in gitoxide gix-transport allows attackers to exploit unfiltered control characters in git-daemon connect requests, enabling the injection of NUL/CR/LF bytes through specially crafted git URLs. This can lead to spoofing of virtual hosts and manipulation of daemon requests and logs, potentially compromising the integrity of the system. Organizations using affected versions should prioritize patching to mitigate the risk of these injection attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.