GHSA-fr8x-3vfx-f45h: gix and gitoxide Unvalidated Submodule Name Traverses Out Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fr8x-3vfx-f45h",
  "modified" : "2026-05-05T19:27:51Z",
  "published" : "2026-05-05T19:27:51Z",
  "aliases" : [ ],
  "summary" : "gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository",
  "details" : "## **Summary**\nattachments:\n[pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip)\n\nSubmodule names coming from `.gitmodules` are exposed as unvalidated names and are later reused to derive the submodule git directory as:\n\n```\n<superproject common_dir>/modules/<submodule name>\n```\n\nBecause the submodule name is joined directly as a filesystem path component, a name such as `../../../escaped-target.git` escapes `.git/modules` after normalization. The current implementation then uses that escaped path in both `state()` and `open()`.\n\nThe updated PoC demonstrates the real sink, not just string construction:\n\n- `state()` reports `repository_exists=true` for the traversed path;\n- `open()` returns a repository whose normalized `common_dir()` matches the attacker-chosen repository outside `.git/modules`.\n\n## **Root cause analysis**\n\nThe relevant flow is:\n\n1. [`gix-submodule/src/access.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix-submodule/src/access.rs) exposes unvalidated submodule names from configuration.\n2. [`gix/src/submodule/mod.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix/src/submodule/mod.rs) derives the git directory by doing `common_dir().join(\"modules\").join(name)` with no confinement check.\n3. [`gix/src/submodule/mod.rs`](https://github.com/GitoxideLabs/gitoxide/blob/v0.52.0/gix/src/submodule/mod.rs) uses that derived path during state resolution and repository opening.\n\nThere is no normalization-and-confinement step between “submodule name from configuration” and “filesystem path used for repository existence checks / open.” As a result, traversal segments in the submodule name directly influence which repository path is inspected and opened.\n\n## **Reproduce steps**\n\nUse the attached PoC zip that contains the `pocs/` workspace.\n\n1. Unzip the PoC archive.\n2. Enter `pocs/F002`.\n3. Run:\n    \n    ```\n    cargo run --quiet\n    ```\n    \n4. Compare the output with `pocs/F002/result.txt`.\n\nKey outputs are:\n\n- `submodule_name=../../../escaped-target.git`\n- `derived_git_dir_raw=.../.git/modules/../../../escaped-target.git`\n- `derived_git_dir_normalized=.../artifacts/escaped-target.git`\n- `escaped_target=.../artifacts/escaped-target.git`\n- `repository_exists=true`\n- `submodule_opened=true`\n- `opened_common_dir_normalized=.../artifacts/escaped-target.git`\n- `normalized_git_dir_matches_target=true`\n- `opened_common_dir_matches_target=true`\n- `target_outside_modules_root=true`\n\nThese outputs show that gitoxide is not only constructing a traversable path string. It is actually using the escaped path for repository existence checks and for opening a repository object.\n\n## **Impact**\n\nConfirmed impact:\n\n- a malicious submodule name can redirect submodule state inspection away from `.git/modules/<name>` to an attacker-chosen repository path outside `.git/modules`;\n- `Submodule::state()` can report repository existence for the wrong repository;\n- `Submodule::open()` can return a repository object backed by that attacker-chosen path.\n\nThis is best described as a path-traversal / repository-confusion issue in submodule repository resolution.\n\nThis report does **not** claim command execution from this behavior alone. The demonstrated impact is repository redirection: callers that enumerate, inspect, or operate on submodules can be steered into using the wrong repository.\n\n## **Recommended fix**\n\nTwo complementary fixes are advisable:\n\n1. do not reuse raw submodule names as filesystem path fragments;\n    - either use a validated/sanitized name for filesystem derivation,\n    - or derive the storage path from a safe identifier instead of the user-controlled name;\n2. add an explicit confinement check after path derivation;\n    - normalize or canonicalize the candidate path,\n    - verify that the result stays under `<common_dir>/modules`,\n    - reject names that contain traversal segments, path separators, or any representation that can escape the modules root.\n\nIn short, submodule names may remain opaque configuration identifiers, but they should not be treated as trusted filesystem subpaths.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "gitoxide"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.52.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.52.0"
    }
  }, {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "gix"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.83.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/GitoxideLabs/gitoxide"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-05T19:27:51Z",
    "nvd_published_at" : null
  }
}