CVE-2025-54585

Executive Summary

CVE-2025-54585 is a critical authorization bypass vulnerability in GitProxy, an application that acts as a policy enforcement proxy between developers and Git remote endpoints. The flaw resides in the way GitProxy handles new branch creation, allowing an attacker with standard push access to bypass the required approval of prior commits on the parent branch. This vulnerability impacts all users or organizations relying on GitProxy to enforce commit approval policies. The attack requires no elevated privileges beyond regular push access and no user interaction, but it does require a GitProxy administrator or designated user (canUserApproveRejectPush) to approve pushes to the child branch. The vulnerability is fixed in version 1.19.2.

Supply Chain & Package Security

GitProxy is a Go-based application. The vulnerability is in the core application logic, not in a dependency. However, organizations using GitProxy as a policy enforcement layer in their CI/CD pipeline should treat this as a critical supply chain risk, as it undermines the integrity of the entire code review and approval process.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs standard push access to a repository.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): High (H) - The attacker can push unapproved changes.
• Availability (A): None (N) - No impact on availability.

CVSS Score: 6.5 (Medium) - The integrity impact is high, but the attack requires some privileges and a specific condition (admin approval on child branch).

Deep Dive & Mechanics

GitProxy is designed to enforce policies on Git pushes, such as requiring approval for commits on a parent branch before they can be merged. The vulnerability arises from a logic flaw in the branch creation flow.

Normal Flow:

1. A developer pushes commits to a parent branch (e.g., main).
2. GitProxy intercepts the push and checks if the commits have been approved.
3. If not approved, the push is rejected.
4. The developer creates a new branch (e.g., feature-x) from the parent branch.
5. GitProxy checks the new branch creation against the policy.

Vulnerable Flow:

1. An attacker pushes unapproved commits to a parent branch (e.g., main).
2. The push is rejected by GitProxy.
3. The attacker then creates a new branch (e.g., feature-x) from the parent branch.
4. GitProxy incorrectly handles the branch creation request. Instead of checking the approval status of the commits on the parent branch, it only checks if the new branch itself has been approved.
5. If a GitProxy administrator or designated user has approved any push to the child branch (e.g., for a legitimate feature), the attacker can exploit this approval to bypass the parent branch's approval requirement.
6. The attacker's unapproved commits are now present on the child branch, effectively bypassing the policy.

The root cause is a missing or incorrect check in the branch creation handler. The code likely checks canUserApproveRejectPush for the target branch but fails to verify that the source commits (from the parent branch) have been approved.

Vulnerable vs. Patched Code

Vulnerable Code (v1.19.1 and below):

func handleCreateBranch(w http.ResponseWriter, r *http.Request) {
    // ... parse request ...
    if !canUserApproveRejectPush(user, targetBranch) {
        http.Error(w, "Unauthorized", http.StatusForbidden)
        return
    }
    // ... create branch ...
    // MISSING: Check if source commits are approved
}

Patched Code (v1.19.2):

func handleCreateBranch(w http.ResponseWriter, r *http.Request) {
    // ... parse request ...
    if !canUserApproveRejectPush(user, targetBranch) {
        http.Error(w, "Unauthorized", http.StatusForbidden)
        return
    }
    // NEW: Check if source commits are approved
    if !areCommitsApproved(sourceBranch, targetBranch) {
        http.Error(w, "Source commits not approved", http.StatusForbidden)
        return
    }
    // ... create branch ...
}

The patch adds a call to areCommitsApproved() which verifies that the commits being branched from have been approved.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a GitProxy instance (v1.19.1 or below).
• A user account with push access to a repository.
• A GitProxy administrator or designated user must have approved a push to a child branch.

Exploitation Steps:

1. Clone the repository: git clone https://gitproxy.example.com/repo.git
2. Make unapproved changes to the parent branch (e.g., main): echo "malicious code" > backdoor.php && git add . && git commit -m "Unapproved change"
3. Attempt to push to main: git push origin main (This will be rejected by GitProxy).
4. Create a new branch from main: git checkout -b exploit-branch
5. Push the new branch: git push origin exploit-branch
6. If an admin has approved any push to exploit-branch, the push will succeed, bypassing the parent branch approval.

Expected Outcome: The unapproved commits are now on exploit-branch, bypassing the policy.

Blue Team

Detection:

• Monitor for branch creation events that do not have a corresponding approved push to the parent branch.
• Look for patterns where a user creates a branch immediately after a rejected push to the parent branch.
• Audit logs for handleCreateBranch calls where the source branch has unapproved commits.

Hunting:

• Query GitProxy logs for handleCreateBranch events where sourceBranch has a recent rejected push.
• Check for branches that contain commits not present in any approved merge request.

Lab Setup:

1. Deploy GitProxy v1.19.1 in a Docker container.
2. Configure a repository with a policy requiring approval for commits on main.
3. Create a user with push access.
4. As an admin, approve a push to a child branch (e.g., feature-x).
5. As the attacker, attempt the exploitation steps above.

Indicators of Compromise (IOCs)

• Log Entry: handleCreateBranch called with sourceBranch having unapproved commits.
• Network: Unusual branch creation requests from a user who recently had a push rejected.
• File: Branches containing commits that are not part of any approved merge request.
• Behavior: A user creates a branch immediately after a rejected push to the parent branch.

Detection Engineering

YARA Rule

rule CVE_2025_54585_GitProxy_Bypass {
    meta:
        description = "Detects GitProxy log entries indicating branch creation bypass"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54585"
    strings:
        $log1 = "handleCreateBranch"
        $log2 = "sourceBranch"
        $log3 = "unapproved"
    condition:
        all of ($log*)
}

Sigma Rule

title: GitProxy Branch Creation Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-54585
author: Valters IT
date: 2025-04-10
logsource:
    product: gitproxy
    service: audit
detection:
    selection:
        EventID: "handleCreateBranch"
        SourceBranchStatus: "unapproved"
    condition: selection
falsepositives:
    - Legitimate branch creation after policy change
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-54585 GitProxy Branch Creation Bypass";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/branch"; http_uri;
    content:"sourceBranch"; http_client_body;
    pcre:"/sourceBranch.*unapproved/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-54585;
    priority:2;
)

Remediation & Mitigation

Immediate:

1. Upgrade GitProxy to version 1.19.2 or later.
2. If upgrade is not possible, restrict branch creation to only trusted users.
3. Review all existing branches for unapproved commits.

Long-term:

1. Implement additional approval checks for branch creation.
2. Monitor GitProxy logs for suspicious branch creation patterns.
3. Conduct a security audit of the GitProxy configuration.

Workaround:

• Disable branch creation for non-admin users until the patch is applied.
• Use a webhook to validate branch creation requests against the approval policy.

Valters IT