CVE-2024-51990: Jujutsu VCS Path Traversal Vulnerability

CVE-2024-51990 Overview

CVE-2024-51990 is a critical Path Traversal vulnerability affecting Jujutsu (jj), a Git-compatible version control system written in Rust. The vulnerability allows specially crafted Git repositories to cause jj to write files outside the intended clone directory, potentially enabling arbitrary file write attacks on the target system.

Critical Impact

Attackers can craft malicious Git repositories that, when cloned with jj, write arbitrary files outside the clone directory, potentially leading to remote code execution through file overwrites.

Affected Products

• Jujutsu (jj) versions prior to 0.23.0
• Git-compatible VCS implementations using vulnerable jj libraries

Discovery Timeline

• November 7, 2024 - CVE CVE-2024-51990 published to NVD
• November 8, 2024 - Last updated in NVD database

Technical Details for CVE-2024-51990

Vulnerability Analysis

This vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The flaw exists in how Jujutsu processes file paths during Git clone operations.

When jj clones a repository, it processes file paths contained within the Git repository data. A malicious repository can include specially crafted path sequences (such as ../ directory traversal patterns) that escape the intended clone directory. This allows an attacker to write files to arbitrary locations on the filesystem where the user running jj has write permissions.

The attack is network-based and requires no authentication or user interaction beyond initiating a clone operation. The vulnerability can compromise both the confidentiality and integrity of the target system, as attackers could overwrite sensitive configuration files, inject malicious scripts, or plant executable files in strategic locations.

Root Cause

The root cause is insufficient validation and sanitization of file paths extracted from Git repository objects during the clone operation. The jj tool failed to properly canonicalize and constrain file paths to the destination directory, allowing path traversal sequences to escape the intended directory boundary.

Attack Vector

The attack is executed remotely over the network. An attacker hosts a malicious Git repository containing files with path traversal sequences in their names. When a victim clones this repository using jj, the malicious paths are processed without proper validation, resulting in files being written outside the clone directory.

For example, a repository could contain an object referencing a file path like ../../../.bashrc or ../../../.ssh/authorized_keys, allowing the attacker to overwrite or create files in sensitive locations on the victim's system.

The attack requires no privileges from the attacker and no special user interaction beyond the victim choosing to clone the malicious repository. Technical details about the specific exploitation mechanism can be found in the GitHub Security Advisory.

Detection Methods for CVE-2024-51990

Indicators of Compromise

• Unexpected file modifications outside of known jj clone directories
• Files appearing in home directories or system paths following jj clone operations
• Git repository URLs from unknown or untrusted sources in shell history
• Unusual file timestamps correlating with recent jj clone activities

Detection Strategies

• Monitor filesystem activity for write operations that traverse outside expected repository directories during jj operations
• Implement file integrity monitoring (FIM) on sensitive directories like ~/.ssh/, ~/.bashrc, and system configuration paths
• Review system logs for jj process activity writing to unexpected locations
• Deploy endpoint detection rules that flag path traversal patterns in file operations initiated by version control tools

Monitoring Recommendations

• Enable audit logging for file system write operations in sensitive directories
• Configure alerts for any version control system attempting to write outside designated workspace directories
• Monitor for newly created or modified files in user home directories that correlate with repository clone events
• Implement baseline monitoring of jj binary behavior to detect anomalous file access patterns

How to Mitigate CVE-2024-51990

Immediate Actions Required

• Upgrade Jujutsu (jj) to version 0.23.0 or later immediately
• Avoid cloning repositories from untrusted or unknown sources until the upgrade is complete
• Review recently cloned repositories and check for unexpected file modifications outside clone directories
• Audit systems that have used vulnerable jj versions for signs of compromise

Patch Information

The vulnerability has been addressed in Jujutsu version 0.23.0. Users should upgrade to this version or later to remediate the vulnerability. The fix implements proper path validation and sanitization to prevent directory traversal during clone operations.

For more information about the patch and the vulnerability, refer to the GitHub Security Advisory GHSA-88h5-6w7m-5w56.

Workarounds

• Avoid cloning repositories from unknown or untrusted sources until upgrading to the patched version
• Run jj clone operations within isolated environments such as containers or virtual machines to limit potential impact
• Use file system sandboxing tools to restrict jj write access to designated directories only
• Implement network-level controls to only allow cloning from trusted repository hosts

# Upgrade jj to the patched version
# Using cargo (Rust package manager)
cargo install --locked --bin jj jj-cli

# Verify the installed version is 0.23.0 or later
jj --version