CVE-2025-54585
📋 TL;DR
CVE-2025-54585 allows attackers with regular push access to bypass GitProxy's commit approval enforcement when creating new branches. This vulnerability affects all organizations using GitProxy versions 1.19.1 and below to enforce policy controls on Git repositories. Attackers can push unapproved changes to child branches without proper oversight.
💻 Affected Systems
- GitProxy
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers bypass all policy enforcement, pushing malicious code or configuration changes to production repositories, potentially leading to supply chain attacks, credential exposure, or system compromise.
Likely Case
Developers bypass approval workflows to push unauthorized changes, violating compliance requirements and potentially introducing security vulnerabilities or breaking builds.
If Mitigated
With proper monitoring and secondary controls, unauthorized changes can be detected and reverted before causing significant damage.
🎯 Exploit Status
Exploitation requires push access and understanding of Git branch creation workflows. No authentication bypass needed beyond regular push permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.19.2
Vendor Advisory: https://github.com/finos/git-proxy/security/advisories/GHSA-39p2-8hq9-fwj6
Restart Required: Yes
Instructions:
1. Stop GitProxy service. 2. Update to version 1.19.2 using package manager or manual installation. 3. Restart GitProxy service. 4. Verify functionality.
🔧 Temporary Workarounds
Disable new branch creation
allTemporarily restrict branch creation permissions to administrators only
git config --system receive.denyCurrentBranch updateInstead
git config --system receive.denyNonFastForwards true
Enhanced monitoring
allImplement additional logging and alerts for branch creation events
Configure Git hooks to log all branch creation events
Set up alerts for unauthorized branch creation patterns
🧯 If You Can't Patch
- Implement mandatory code review requirements outside of GitProxy for all branch merges
- Deploy network segmentation to restrict GitProxy access to authorized users only
🔍 How to Verify
Check if Vulnerable:
Check GitProxy version: git-proxy --version or examine package version. If version is 1.19.1 or lower, system is vulnerable.Check Version:
git-proxy --versionVerify Fix Applied:
After updating, verify version is 1.19.2 or higher. Test branch creation with approval policies to ensure they are properly enforced.📡 Detection & Monitoring
Log Indicators:
- Unexpected branch creation events
- Pushes to new branches without prior approval logs
- Mismatch between approval timestamps and push events
Network Indicators:
- Unusual Git push patterns to new branches
- Increased frequency of branch creation requests
SIEM Query:
source="git-proxy" AND (event="branch_creation" OR event="push") | stats count by user, branch, timestamp