-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @finos/git-proxy | npm | <= 1.19.1 | 1.19.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in GitProxy's handling of git push operations, specifically in how it parses and verifies the commits being pushed. The root cause is improper parsing of the git packfile protocol and commit data, which allows an attacker to bypass approval mechanisms.
The exploit involves creating a new branch from an unapproved commit on a parent branch. When the new branch (with a new, approved commit) is pushed, the proxy is tricked into accepting the unapproved parent commit as well. This happens because the functions responsible for parsing the push (parsePush.exec) and the commit data (getCommitData) are not robust enough to detect the 'hidden' unapproved commits from the parent branch.
The patch addresses this by:
parsePush.exec: It now correctly parses the git packet-line format to accurately determine the old and new commit hashes and the branch being updated.getCommitData: It now uses a more robust method to parse commit objects, ensuring all commit details (like parents) are correctly identified.checkHiddenCommits.exec: A new processor is added to the chain (checkHiddenCommits) which explicitly verifies that all commits in the pushed packfile are actually part of the advertised commit range for the branch. This directly prevents the exploit by detecting any unreferenced (hidden) commits.getMissingData.exec: This function is added to handle cases where commit data might be missing from the initial parsing, ensuring the proxy has a complete view of the commit history before making decisions.The identified vulnerable functions, parsePush.exec and getCommitData, are central to the processing of the malicious input (the crafted git push). getDiff.exec is also implicated as it relies on the flawed output of the parsing functions to determine what changes to show for approval.