Description

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-28T12:16:38.317Z",
  "pubdate": "2026-08-28T12:16:38.317Z",
  "executiveSummary": "A critical security vulnerability exists in the curl-based transport backend of gitoxide, starting from version 0.25.4. This issue involves an improper credential handling mechanism during HTTP redirects, resulting in the leakage of sensitive authentication information to unauthorized, attacker-controlled servers.\nThe vulnerability is characterized by a failure to re-validate the target domain following an HTTP redirect. Consequently, when a client follows a redirect, the gitoxide transport layer mistakenly applies credentials intended for the original host to the new, potentially malicious, destination.\nThis flaw exposes users to cross-domain credential harvesting and protocol downgrade attacks. An attacker capable of influencing the redirect target can intercept authentication tokens, enabling unauthorized access to the victim's private repositories or associated services.\nThe risk is significant for automated systems or developers using gitoxide to interact with remote Git servers, as the exploitation is seamless and requires no user interaction beyond the initial connection attempt. Organizations relying on affected versions must prioritize updates or implement strict transport security policies to mitigate the threat of credential exfiltration.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the credential management logic within the curl-based transport backend of gitoxide. Specifically, the client validates the destination host against stored credentials based exclusively on the initial request URL. When the backend receives an HTTP redirect (e.g., 301, 302, 307, or 308), the underlying curl engine processes the redirect to a new effective URL. However, gitoxide fails to perform a secondary verification of the effective URL against the previously scoped credentials before attaching them to the request headers.\nThe attack flow follows a structured exploitation path. An attacker hosts a malicious Git server or a compromised intermediary that is capable of responding with a redirect directive. When a gitoxide-based client initiates a request to a legitimate domain, the attacker intercepts the request and issues an HTTP redirect to an attacker-controlled endpoint. Because the gitoxide client retains the Authorization headers and credentials associated with the primary, legitimate domain, it propagates these sensitive headers to the malicious server upon following the redirect.\nThis behavior facilitates several critical attack scenarios. First, cross-domain redirection allows an attacker to capture headers by redirecting requests to a server they control under a different domain. Second, the vulnerability permits protocol downgrade attacks, where an attacker redirects an initial HTTPS request to an HTTP endpoint. While the client expects a secure connection, the improper handling of credentials ensures that the plain-text headers are transmitted over an insecure, unencrypted channel, making them susceptible to interception via man-in-the-middle (MitM) positioning.\nThe affected component is the transport layer responsible for interfacing with libcurl. Versions from 0.25.4 are confirmed to be vulnerable. Exploitation does not require elevated privileges or pre-existing authentication on the attacker's server, as the victim's client provides the authentication material automatically. The post-exploitation impact includes the full compromise of the user's Git credentials, potentially granting the attacker write access to protected repositories, internal source code, and associated CI/CD pipeline integrations. The lack of domain-binding validation for credentials during redirection constitutes a failure in maintaining the security context of the session, effectively bypassing the intended scope of authentication."
}