CVE-2025-24890: gitoxide Authentication Bypass Vulnerability

CVE-2025-24890 is an authentication bypass flaw in gitoxide on Windows that allows repositories controlled by other users to be incorrectly treated as trusted when administrators run programs with elevated tokens. This article covers technical details, affected versions, exploitation scenarios, and mitigation strategies.

CVE-2025-24890 Overview

CVE-2025-24890 affects gitoxide, a Rust implementation of git, prior to version 0.13.3. The gix-sec crate on Windows incorrectly treats repositories owned by other users as trusted when an administrator runs a dependent program with an unfiltered elevated token. The flaw resides in gix_sec::identity::is_path_owned_by_current_user within gix-sec/src/identity.rs. Administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than the directory owner. This bypasses safe.directory-style protections and allows repository configuration or hooks to execute commands with administrator privileges.

Critical Impact
An elevated administrator interacting with a repository controlled by a limited user can trigger execution of attacker-controlled repository hooks or configuration under the administrator's security context.

Affected Products

gitoxide gix-sec crate versions prior to 0.13.3
Windows-based applications that depend on gix-sec trust results
Programs invoked from an elevated administrator token (unfiltered)

Discovery Timeline

2026-09-14 - CVE-2025-24890 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2025-24890

Vulnerability Analysis

The vulnerability is an origin validation error classified under [CWE-283] (Unverified Ownership). The gix-sec crate is responsible for determining whether a git repository can be trusted based on filesystem ownership. On Windows, it must compare the repository directory owner against the current process identity to prevent execution of hostile repository configuration.

The defective logic in is_path_owned_by_current_user fetches both folder_owner and token_owner. When the process runs elevated, the function delegates to administrator-specific branches that call IsWellKnownSid and CheckTokenMembership. These calls describe the running token rather than confirming that the folder owner matches the administrator identity. Any repository owned by a limited user then returns as trusted.

Once trust is granted, standard git behavior applies. Repository-local configuration and hook scripts execute during normal operations such as status, fetch, or log, giving the attacker code execution in the administrator context.

Root Cause

The check confirms only that the current token belongs to the Administrators group. It never validates that the folder owner SID matches the token owner. The comparison of directory ownership to caller identity is missing on the administrator path.

Attack Vector

Exploitation requires Windows, an elevated administrator process built on gix-sec, and a repository controlled by another local user. The attacker plants a .git/config with a malicious core.fsmonitor, core.editor, or hook script. When the administrator performs an operation that reads configuration or triggers hooks, the payload runs with elevated rights. Unelevated User Account Control (UAC) processes are not affected. Cloning is not affected because repository configuration and hooks are not copied by clone.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-7rhf-42qf-vrvc for advisory details.

Detection Methods for CVE-2025-24890

Indicators of Compromise

Repository directories under user-writable paths (for example, C:\Users\<user>\) accessed by processes running as NT AUTHORITY\SYSTEM or elevated administrators
Modification timestamps on .git/config, .git/hooks/, or .gitattributes shortly before an administrator-context child process spawns
Unexpected child processes such as cmd.exe, powershell.exe, or scripting hosts launched by an application that embeds gitoxide

Detection Strategies

Inventory Rust binaries and applications that depend on the gix-sec crate at versions below 0.13.3
Monitor process trees where an elevated parent process interacts with git repositories located in another user's profile directory
Alert on writes to .git/config values that reference executable paths, such as core.fsmonitor, core.pager, or hook entries

Monitoring Recommendations

Enable Windows Security event auditing for token elevation events and process creation with command-line capture
Correlate file access events on .git/hooks/* and .git/config with the effective user of the accessing process
Ingest endpoint process telemetry into a centralized data lake to hunt for elevated processes traversing non-administrator repository paths

How to Mitigate CVE-2025-24890

Immediate Actions Required

Upgrade gitoxide and any dependent applications to a build that includes gix-sec version 0.13.3 or later
Audit all Windows tooling that consumes gix-sec trust results and rebuild against the fixed crate
Instruct administrators to avoid running elevated git-consuming tools against repositories located under other users' profiles

Patch Information

The issue is fixed in gix-sec version 0.13.3. Review the GitHub Commit Details, the GitHub Pull Request #2510, and the gix-sec-v0.13.3 release notes for the corrected ownership comparison logic.

Workarounds

Run git-consuming applications without elevation whenever possible; unelevated UAC processes are not affected
Restrict administrators from interacting with repositories owned by non-administrator local users until the patched crate is deployed
Copy repositories into an administrator-owned directory before performing operations that read configuration or run hooks

bash

# Verify the resolved gix-sec version in a Rust project
cargo tree -p gix-sec

# Force upgrade to the patched release
cargo update -p gix-sec --precise 0.13.3