-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability in GitProxy allows an attacker to bypass branch protection rules by pushing unapproved commits. This is achieved by creating a new branch from an unapproved commit, making an approved commit on the new branch, and then pushing the original branch again. The root cause of this vulnerability lies in the improper handling and parsing of the git push data, particularly in the parsePush.ts and getDiff.ts files.
The parsePush.exec function had a naive implementation for parsing the git protocol, which could be easily fooled. The getCommitData function was also fragile and could misinterpret commit objects. Furthermore, the getDiff.exec function had flawed logic for determining the base commit of a new branch, which allowed the unapproved commits to be excluded from the security checks.
The patch addresses these issues by introducing a new processor, checkHiddenCommits, which explicitly checks for commits in the push that are not part of the declared range of commits for the branch being pushed. This prevents the "hiding" of unapproved commits. The patch also significantly improves the parsing logic in parsePush.ts to be more robust and compliant with the git protocol, and it adds a getMissingData processor to handle cases where commit data is not immediately available in the push pack. The combination of these changes ensures that all commits being pushed are properly accounted for and validated against the defined policies.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @finos/git-proxy | npm | <= 1.19.1 | 1.19.2 |