Executive brief
GitProxy is a tool used by organizations to enforce security policies on Git repositories by scanning and approving commits before they are merged. An attacker with push access can exploit a flaw in how GitProxy parses Git packfiles to hide malicious commits from scanning, allowing them to bypass approval policies and insert unwanted code into protected repositories.
Technical details
The vulnerability is an improper input validation flaw in parsePush.ts that uses a naive string search to locate Git packfiles by finding the last occurrence of "PACK" in the buffer. An attacker can craft a malicious packfile containing the "PACK" string within commit content (blobs or commit bodies), causing the parser to treat arbitrary data as the packfile start and ignore the actual push payload. This allows bypassing commit approval scanning and policy enforcement. The attack requires push access to the repository and considerable technical skill to craft a valid Git packfile, but no elevation of privilege or user interaction. Fixed in versions 1.19.2 and 2.0.0.
Affected products
- FINOS git-proxy <=1.19.1
Timeline
- 2025-07-30: disclosed
- 2025-07-30: patched: Patched in versions 1.19.2 and 2.0.0