PT-2025-31446 · Gitproxy · Git-Proxy
Jescalada
·
Published
2025-07-30
·
Updated
2025-07-30
·
CVE-2025-54585
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N |
Name of the Vulnerable Software and Affected Versions
GitProxy versions 1.19.1 and below
Description
GitProxy is an application that acts as an intermediary between developers and a Git remote endpoint. A flaw in how GitProxy handles new branch creation allows attackers to bypass the approval of prior commits on the parent branch. This impacts users and organizations that rely on GitProxy to enforce policy and prevent unauthorized changes. Exploitation requires regular push access and the approval of a GitProxy administrator or designated user (
canUserApproveRejectPush) for pushes to the child branch. The vulnerability stems from GitProxy checking for a specific hash (0000000000000000000000000000000000000000) to detect new branches, which can be exploited to push unapproved commits from a parent branch.Recommendations
Update GitProxy to version 1.19.2 or later.
Exploit
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Git-Proxy