CVE-2025-54586
📋 TL;DR
GitProxy versions 1.19.1 and below allow attackers to inject hidden commits into Git packs sent to GitHub. These commits don't appear in branch history but remain accessible via direct URLs, enabling data exfiltration without visible traces. Organizations using vulnerable GitProxy versions are affected.
💻 Affected Systems
- GitProxy
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of repository confidentiality with sensitive data exfiltrated without detection in version control history.
Likely Case
Attackers exfiltrate source code, credentials, or other sensitive data from private repositories.
If Mitigated
No data exfiltration occurs due to proper access controls and monitoring.
🎯 Exploit Status
Requires attacker access to GitProxy endpoint and knowledge of target repository structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.19.2
Vendor Advisory: https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g
Restart Required: Yes
Instructions:
1. Stop GitProxy service. 2. Update to version 1.19.2 via package manager or manual installation. 3. Restart GitProxy service. 4. Verify version with 'gitproxy --version'.
🔧 Temporary Workarounds
Disable GitProxy
linuxTemporarily disable GitProxy and use direct Git connections
sudo systemctl stop gitproxy
sudo systemctl disable gitproxy
🧯 If You Can't Patch
- Implement strict network access controls to limit GitProxy exposure
- Enable detailed logging of all GitProxy transactions and monitor for unusual patterns
🔍 How to Verify
Check if Vulnerable:
Check GitProxy version with 'gitproxy --version' or examine package versionCheck Version:
gitproxy --versionVerify Fix Applied:
Confirm version is 1.19.2 or higher and test Git operations through proxy📡 Detection & Monitoring
Log Indicators:
- Unusual Git pack sizes
- Multiple commit operations from single sources
- Failed commit validations
Network Indicators:
- Abnormal Git protocol traffic patterns
- Large pack file transfers
SIEM Query:
source="gitproxy" AND (event="pack_upload" OR event="commit_push") AND size>threshold🔗 References
- https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110
- https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a
- https://github.com/finos/git-proxy/releases/tag/v1.19.2
- https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g
- https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g
