Executive brief
GitBucket, a self-hosted Git platform, contains a critical security flaw that allows unauthorized users to take complete control of the server. An attacker can bypass security checks to upload malicious files and execute arbitrary system commands. This could lead to the theft of source code, total service disruption, or the use of the server as a foothold for further attacks on the corporate network.
Technical details
GitBucket 4.23.1 is vulnerable to unauthenticated remote code execution (RCE) stemming from a combination of weak secret token generation and path traversal in file uploads. The application uses a weak Blowfish encryption key that can be easily brute-forced. Once the key is obtained, an attacker can craft an 'Authorization' header to interact with the Git LFS endpoint. By exploiting insecure file parameter handling, an attacker can perform a directory traversal to upload a malicious JAR file into the GitBucket plugins directory. The application then loads this plugin, allowing the attacker to execute arbitrary system commands via a newly exposed endpoint. This vulnerability specifically affects installations running on Windows. Users should update to version 4.24.1 or later to remediate this issue.
Affected products
- GitBucket GitBucket 4.23.1 and earlier
Timeline
- 2018-05-21: disclosed: Initial exploit and vulnerability details published by Kacper Szurek
- 2026-05-17: advisory: CVE-2018-25332 published to NVD via VulnCheck enrichment