CVE-2025-54583
📋 TL;DR
GitProxy versions 1.19.1 and below contain an authorization bypass vulnerability that allows users to push code to remote repositories without triggering required policy checks or approvals. This could enable developers to push sensitive data, malicious code, or unauthorized changes directly into production repositories. Organizations using GitProxy for Git operations are affected.
💻 Affected Systems
- GitProxy
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could push malicious code containing backdoors, secrets, or malware directly into production repositories, potentially compromising entire software supply chains and downstream systems.
Likely Case
Developers accidentally or intentionally bypass security policies to push code containing secrets, vulnerabilities, or unauthorized changes that would normally be blocked.
If Mitigated
If proper network segmentation and access controls are in place, the impact is limited to unauthorized code pushes within the GitProxy environment.
🎯 Exploit Status
Exploitation requires valid GitProxy user credentials but no special technical knowledge beyond normal Git operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.19.2
Vendor Advisory: https://github.com/finos/git-proxy/security/advisories/GHSA-qr93-8wwf-22g4
Restart Required: Yes
Instructions:
1. Stop GitProxy service. 2. Backup current configuration. 3. Upgrade to version 1.19.2 using package manager or manual installation. 4. Restart GitProxy service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable GitProxy push operations
allTemporarily disable all push operations through GitProxy while maintaining read-only access
git config --global --add proxy.denyPush true
Implement network-level restrictions
allUse firewall rules to restrict GitProxy access to trusted networks only
🧯 If You Can't Patch
- Implement mandatory code review requirements for all repository pushes
- Deploy additional security scanning tools that inspect commits before they reach production
🔍 How to Verify
Check if Vulnerable:
Check GitProxy version: git-proxy --version or examine package manager outputCheck Version:
git-proxy --versionVerify Fix Applied:
Confirm version is 1.19.2 or higher and test that policy checks trigger on push attempts📡 Detection & Monitoring
Log Indicators:
- Push operations without corresponding policy check logs
- Successful pushes from users who previously had push requests denied
- Unusual push patterns or timing
Network Indicators:
- Git push traffic bypassing expected approval workflows
- Direct repository access without proxy intervention
SIEM Query:
source="git-proxy" AND (event="push" AND NOT event="policy_check")