Listen to this Post
How the CVE Works
GitProxy uses the `0000000000000000000000000000000000000000` hash to detect new branches in `getDiff.ts` and parsePush.ts. An attacker can exploit this by:
1. Committing unapproved changes in branch `a` (e.g., main).
2. Creating a new branch `b` from `a` and pushing approved changes to b.
3. Returning to `a` and pushing the unapproved commits, bypassing policy checks.
GitProxy versions before 1.19.2 allow this bypass, while later versions enforce approval for parent branch commits during merges.
DailyCVE Form
Platform: GitProxy
Version: <1.19.2
Vulnerability: Approval Bypass
Severity: High
Date: 2023-10-05
Prediction: Patch expected by 2023-10-20
What Undercode Say
git checkout -b a origin/main echo "DEBUG=true" > config.env git add config.env git commit -m "Sensitive debug config" git push proxy a
How Exploit
1. Push unapproved commit to branch `a`.
2. Create branch `b` and get approval.
3. Push unapproved changes from `a` via merge.
Protection from this CVE
- Upgrade to GitProxy ≥1.19.2.
- Enforce explicit approvals for parent branch commits.
Impact
- Bypasses GitProxy policy checks.
- Allows unauthorized code pushes.
- Affects system integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
