gix-url authority parse bug: redirect identity guard fails, leaking HTTP Basic credentials

Vulnerability Summary: gix-url authority is not terminated by / , causing the gix-transport redirect identity guard to fail and leak HTTP Basic credentials Overview Title: The authority parsing in does not treat or as terminators of the authority component, which causes the redirect identity guard ( ) in to fail after redirection, resulting in the leakage of HTTP Basic credentials. Root Cause: The function in treats everything before and as part of the authority when parsing a URL, causing and to be incorrectly included in the authority. Impact: When handles a redirect, due to the parsing error in , the function fails to correctly compare the authority components of the original URL and the redirect URL. Consequently, the identity guard is bypassed, and HTTP Basic credentials may be erroneously sent after redirection. Scope of Impact Affected Packages: - (Rust): Affected versions , Fixed in versions - (Rust): Affected versions , Fixed in versions CVE ID: No known CVE Severity: High Weaknesses: CWE-502 (Sensitive Information Leakage via HTTP Redirect), CWE-136 (Improper Input Handling) Remediation 1. Fix: In the function in , treat and as terminators for the authority component, ensuring that the authority does not include query parameters or fragments. 2. Fix: In the function in , use the function from to parse the URL, and correctly compare the authority components of the original and redirect URLs, ensuring the identity guard remains effective after redirection. PoC Code Reproduction Steps 1. Start two local HTTP servers without an external host. 2. Clone via the CLI, where the server listens on . 3. The clone fails because the client clones a server with the same string, while clones , and the server returns a 302 with a header in form, pointing to . 4. The server on port returns a 302, with its header in form, pointing to . 5. The client sends HTTP Basic credentials after the redirect, causing credential leakage.

Goal Reached Thanks to every supporter — we hit 100%!

gix-url authority parse bug: redirect identity guard fails, leaking HTTP Basic credentials

More from this source