CVE-2023-53158: OS Command Injection
The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution.
PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'
This will launch a calculator on OSX.
See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.
Thanks for vin01 for disclosing this issue.
Other sources
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53158?
CVE-2023-53158 has a high severity as it allows for command execution via specially crafted SSH commands.
How do I fix CVE-2023-53158?
To fix CVE-2023-53158, update the gix-transport crate to version 0.36.1 or later.
What versions of gix-transport are affected by CVE-2023-53158?
CVE-2023-53158 affects gix-transport versions prior to 0.36.1.
Can CVE-2023-53158 be exploited remotely?
Yes, CVE-2023-53158 can potentially be exploited remotely through malicious SSH commands.
Is CVE-2023-53158 similar to other vulnerabilities?
Yes, CVE-2023-53158 is similar to CVE-2024-32884, but it is less complex to exploit.