Executive brief
GitProxy is a tool used to enforce code review policies and prevent unauthorized code changes from being pushed to repositories. A flaw in the push parsing logic allows attackers with regular push access to bypass approval workflows by pushing multiple branches simultaneously—the proxy only validates the first branch while silently accepting subsequent ones, potentially allowing malicious or unapproved code to reach the repository.
Technical details
The vulnerability exists in the parsePush.ts component, which processes git push operations but only validates the first branch in a multi-branch push while silently ignoring subsequent branches. An attacker with standard push access can craft a push request with multiple branch references (e.g., `git push proxy safe-branch bad-branch`), causing the proxy to approve and process only the first branch while the second bypasses all checks, policies, and approval workflows. The attack requires push access and a prior approval of the first branch, but no elevated privileges or user interaction beyond initiating the push. The fix involves enforcing single-branch push validation and rejecting multi-branch requests before policy checks are applied. Patched versions 1.19.2 and 2.0.0 are available.
Affected products
- FINOS GitProxy <= 1.19.1
Timeline
- 2025-07-30: disclosed
- 2025-07-30: patched: versions 1.19.2 and 2.0.0 released