An unauthenticated attacker can exploit a URL parsing vulnerability in the gitoxide library to exfiltrate sensitive HTTP Basic credentials to a remote, malicious server.

The gix-url crate uses a custom URL parser that fails to properly terminate the authority component when encountering characters like '?' or '#'. This enables an unauthenticated attacker to manipulate HTTP redirects, causing the library to erroneously transmit authentication credentials to a host controlled by the attacker.

The successful exploitation of this vulnerability results in the unauthorized disclosure of sensitive credentials, which could lead to full account takeover or unauthorized access to private repositories and infrastructure. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to the confidentiality of organizational data. Exploitation is trivial for an attacker, as it does not require prior authentication or user interaction to facilitate the credential leak.

Immediate Action: Update the gitoxide library to versions 0.37.1 or later for gix-url and 0.58.1 or later for gix-transport to resolve the parsing flaw.

Proactive Monitoring: Review egress traffic logs for suspicious HTTP requests directed toward unknown or external domains following redirect events.

Compensating Controls: Implement strict URL validation or allow-listing for outbound connections within your application environment to prevent connections to unauthorized endpoints.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to credential security for any systems utilizing the affected gitoxide crates. Development teams must prioritize upgrading to the patched versions immediately to prevent the potential leakage of authentication tokens. Due to the ease of exploitability and the potential for severe data compromise, this update should be integrated into the next deployment cycle without delay.