CVE-2025-10760 Overview
CVE-2025-10760 is a server-side request forgery (SSRF) vulnerability in Harness 3.3.0. The flaw resides in the LookupRepo function within app/api/controller/gitspace/lookup_repo.go. Attackers can manipulate the url argument to force the server to issue arbitrary outbound requests. The attack is executable remotely and requires only low-privileged access. The vendor was contacted before public disclosure but did not respond, and a proof-of-concept exploit has been published. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery).
Critical Impact
Authenticated remote attackers can coerce the Harness backend into issuing arbitrary HTTP requests, enabling reconnaissance of internal services and cloud metadata endpoints.
Affected Products
- Harness 3.3.0
- Component: app/api/controller/gitspace/lookup_repo.go
- Affected function: LookupRepo
Discovery Timeline
- 2025-09-21 - CVE-2025-10760 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10760
Vulnerability Analysis
The vulnerability affects the Gitspace repository lookup workflow in Harness. The LookupRepo handler accepts a user-supplied url parameter and dispatches a server-side request to that destination without adequate validation of the target host. Because the request originates from the Harness backend, it inherits the network position and outbound trust boundaries of that service. This enables an attacker to reach hosts that would otherwise be unreachable from the public internet, including internal management interfaces, container registries, and cloud provider metadata services. A public proof-of-concept has been released, increasing the practical risk to exposed deployments.
Root Cause
The root cause is insufficient input validation on the url argument passed to LookupRepo in app/api/controller/gitspace/lookup_repo.go. The function does not enforce an allowlist of permitted hosts or schemes and does not block requests to private IP ranges, loopback addresses, or link-local metadata endpoints. This maps directly to CWE-918: Server-Side Request Forgery.
Attack Vector
Exploitation requires network access to the Harness API and a low-privileged authenticated session. The attacker submits a crafted request to the Gitspace lookup endpoint with the url argument pointing at an internal or sensitive target. The Harness server then issues the outbound request and, depending on response handling, may return information from the target back to the attacker. See the published proof-of-concept for full technical details.
No verified exploit code is reproduced here. Refer to the VulDB entry #325115 and the linked PoC repository for the specific request format.
Detection Methods for CVE-2025-10760
Indicators of Compromise
- Outbound HTTP requests from the Harness backend to internal RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
- Repeated API calls to the Gitspace lookup_repo endpoint with non-standard or private-scope URLs in the url parameter.
- Anomalous DNS resolution requests originating from the Harness service host for internal hostnames.
Detection Strategies
- Inspect Harness application logs for LookupRepo invocations and correlate the supplied url argument against an allowlist of expected Git hosting providers.
- Deploy egress filtering telemetry to flag connections from the Harness service to non-repository destinations.
- Alert on any HTTP request from the application host to link-local or metadata IP ranges.
Monitoring Recommendations
- Forward Harness API access logs and outbound proxy logs to a centralized analytics platform for correlation.
- Baseline normal repository-lookup traffic and alert on statistical deviations in destination hosts or ports.
- Monitor cloud audit trails (AWS IMDS, Azure IMDS, GCP metadata) for access originating from the Harness workload identity.
How to Mitigate CVE-2025-10760
Immediate Actions Required
- Restrict network egress from the Harness backend to only the Git hosts required for Gitspace operations.
- Enforce IMDSv2 or equivalent metadata protections on cloud instances hosting Harness to blunt metadata-service abuse.
- Audit access to the Gitspace lookup endpoint and revoke unused low-privileged accounts that could reach the API.
Patch Information
At the time of publication, no vendor patch has been referenced in the NVD entry, and the vendor did not respond to the disclosure. Track the VulDB advisory and the Harness project release notes for a fixed version and upgrade as soon as a patched build is available.
Workarounds
- Place the Harness backend behind an egress proxy that enforces an allowlist of permitted Git provider domains and rejects private, loopback, and link-local destinations.
- Deploy a web application firewall rule that blocks requests to the Gitspace lookup_repo endpoint containing internal IP literals or non-HTTPS schemes in the url parameter.
- Segment the Harness deployment into a dedicated network zone with no route to sensitive internal management interfaces.
# Example egress allowlist enforced via iptables on the Harness host
iptables -A OUTPUT -p tcp -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -p tcp -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -p tcp -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -p tcp -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -p tcp -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
