CVE-2025-25975: Parse-git-config Information Disclosure

CVE-2025-25975 Overview

An information disclosure vulnerability exists in the parse-git-config npm package version 3.0.0. The vulnerability resides in the expandKeys function, which can be exploited by an attacker to obtain sensitive information. This package is commonly used by Node.js applications to parse Git configuration files, making this vulnerability potentially impactful for development environments and CI/CD pipelines that rely on this functionality.

Critical Impact

Attackers can leverage the vulnerable expandKeys function to extract sensitive configuration data, potentially exposing credentials, repository URLs, and other confidential Git settings.

Affected Products

• jonschlinkert parse-git-config version 3.0.0
• Applications and build systems utilizing parse-git-config for Git configuration parsing
• CI/CD pipelines with dependencies on the affected package version

Discovery Timeline

• 2025-03-12 - CVE-2025-25975 published to NVD
• 2025-04-02 - Last updated in NVD database

Technical Details for CVE-2025-25975

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists within the expandKeys function of the parse-git-config package, which is designed to expand and process Git configuration key-value pairs. Due to improper handling of configuration data during the expansion process, an attacker can craft inputs that cause the function to leak sensitive information that should otherwise be protected.

The parse-git-config package is a utility that reads and parses .gitconfig and .git/config files, making configuration values available to Node.js applications. The expandKeys function specifically handles the expansion of nested configuration sections, and the vulnerability allows unauthorized access to sensitive values during this process.

Root Cause

The root cause of this vulnerability lies in the insufficient access controls and improper data handling within the expandKeys function. When processing Git configuration files, the function fails to properly restrict access to sensitive configuration values, allowing them to be exposed to unauthorized parties. This represents a fundamental information exposure flaw where the function does not adequately protect confidential data during the key expansion operation.

Attack Vector

The vulnerability can be exploited remotely over the network without requiring authentication or user interaction. An attacker could exploit this vulnerability by:

1. Targeting applications that use parse-git-config to process user-supplied or externally-sourced Git configuration data
2. Crafting malicious input that triggers the vulnerable expandKeys function
3. Extracting sensitive configuration values such as credentials, tokens, or repository URLs from the exposed data

The attack has high confidentiality impact, as it can result in the disclosure of sensitive Git configuration data including authentication credentials and repository access tokens.

For detailed technical information about this vulnerability, refer to the GitHub Issue Discussion where the security concern has been documented.

Detection Methods for CVE-2025-25975

Indicators of Compromise

• Unexpected access patterns to Git configuration files in application logs
• Unusual data exfiltration attempts from applications using parse-git-config
• Anomalous network traffic from Node.js applications that process Git configurations
• Evidence of unauthorized access to repository credentials or tokens

Detection Strategies

• Audit application dependencies for parse-git-config version 3.0.0 using npm audit or yarn audit
• Monitor application logs for suspicious calls to the expandKeys function with unusual inputs
• Implement Software Composition Analysis (SCA) tools to identify vulnerable package versions
• Review application code for direct usage of the expandKeys function with untrusted input

Monitoring Recommendations

• Enable verbose logging for applications that parse Git configuration files
• Set up alerts for credential rotation events that may indicate compromise
• Monitor for unauthorized access attempts to Git repositories using potentially leaked credentials
• Implement runtime application security monitoring for Node.js environments

How to Mitigate CVE-2025-25975

Immediate Actions Required

• Identify all applications in your environment using parse-git-config version 3.0.0
• Review the GitHub Issue Discussion for the latest remediation guidance
• Consider implementing input validation before passing data to the expandKeys function
• Rotate any Git credentials that may have been exposed through affected applications

Patch Information

As of the last modification date (2025-04-02), organizations should monitor the parse-git-config GitHub repository for updates and patches addressing this vulnerability. Check for newer versions of the package that may contain security fixes, and evaluate alternative packages if a patch is not available.

Workarounds

• Avoid using the expandKeys function with untrusted or user-supplied input data
• Implement strict input validation and sanitization before processing Git configuration files
• Consider using alternative Git configuration parsing libraries that are not affected
• Isolate applications using the vulnerable package in restricted network environments
• Apply the principle of least privilege to limit the sensitivity of data accessible to affected applications

# Check if your project uses the vulnerable version
npm list parse-git-config

# If affected, check for available updates
npm outdated parse-git-config

# Consider pinning to a patched version when available
npm install parse-git-config@<patched-version>