gix-path can use a fake program files location

{
  "id": "10d557fe255e62d95fccc6b4ed043c5ecd864a3ae4bce036647c00546c4c3783",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2024-0355",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "gix-path can use a fake program files location",
    "summary": "### Summary When looking for Git for Windows so it can run it to report its paths, `gix-path` can be tricked into running another `git.exe` placed in an untrusted location by a limited user account. ### Details Windows permits limited user accounts without administrative privileges to create new directories in the root of the system drive. While `gix-path` first looks for `git` using a `PATH` search, in version 0.10.8 it also has a fallback strategy on Windows of checking [two hard-coded paths](https://github.com/Byron/gitoxide/blob/6cd8b4665bb7582f744c3244abaef812be39ec35/gix-path/src/env/git.rs#L9-L14) intended to be the 64-bit and 32-bit Program Files directories: ```rust /// Other places to find Git in. #[cfg(windows)] pub(super) static ALTERNATIVE_LOCATIONS: &[&str] = &[ \"C:/Program Files/Git/mingw64/bin\", \"C:/Program Files (x86)/Git/mingw32/bin\", ]; ``` Existing functions, as well as the newly introduced `exe_invocation` function, were updated to make use of these alternative locations. This causes facilities in `gix_path::env` to directly execute `git.exe` in those locations, as well as to return its path or whatever configuration it reports to callers who rely on it. Although unusual setups where the system drive is not `C:`, or even where Program Files directories have non-default names, are technically possible, the main problem arises on a 32-bit Windows system. Such a system has no `C:\\Program Files (x86)` directory. A limited user on a 32-bit Windows system can t",
    "evidence": "osv:RUSTSEC-2024-0355",
    "products": [
      {
        "name": {
          "value": "gix-path",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.10.9",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "RUSTSEC-2024-0355",
      "aliases": [
        "CVE-2024-40644",
        "GHSA-mgvv-9p9g-3jv4",
        "RUSTSEC-2024-0355"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.10.8"
                },
                {
                  "fixed": "0.10.9"
                }
              ]
            }
          ],
          "package": {
            "name": "gix-path",
            "purl": "pkg:cargo/gix-path",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0355.json",
            "categories": [
              "code-execution",
              "privilege-escalation"
            ],
            "informational": null
          },
          "ecosystem_specific": {
            "affects": {
              "os": [
                "windows"
              ],
              "arch": [],
              "functions": [
                "gix_path::env::exe_invocation",
                "gix_path::env::installation_config",
                "gix_path::env::installation_config_prefix",
                "gix_path::env::system_prefix"
              ]
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-12T18:00:12.400481123Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/gix-path",
        "https://rustsec.org/advisories/RUSTSEC-2024-0355.html",
        "https://github.com/GitoxideLabs/gitoxide/commit/15235bf7968042da0493d431bbc955d6f9f54188",
        "https://github.com/advisories/GHSA-mgvv-9p9g-3jv4"
      ],
      "provider_metadata": {
        "license": "CC0-1.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-40644",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 306424,
  "published_at": "2024-07-18T12:00:00+00:00"
}