CVE-2025-54583: Finos Gitproxy Auth Bypass Vulnerability

CVE-2025-54583 Overview

CVE-2025-54583 is an authorization vulnerability in FINOS GitProxy, an application that sits between developers and Git remote endpoints such as github.com. GitProxy enforces policies and requires explicit approvals before pushes reach the upstream repository. Versions 1.19.1 and below allow users to push to remote repositories while bypassing those policies and approvals. Because checks and plugins are skipped, code containing secrets, unauthorized modifications, or unwanted changes can reach the repository without review. The issue is tracked under CWE-863: Incorrect Authorization and is fixed in version 1.19.2.

Critical Impact
Authenticated users can push arbitrary code to protected Git repositories without triggering approval workflows, plugin checks, or policy enforcement.

Affected Products

FINOS GitProxy versions 1.19.1 and below
Git repositories fronted by vulnerable GitProxy deployments
CI/CD pipelines relying on GitProxy for pre-push policy enforcement

Discovery Timeline

2025-07-30 - CVE-2025-54583 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54583

Vulnerability Analysis

GitProxy processes Git push operations through a chained sequence of steps defined in src/proxy/chain.ts. Each step performs a specific check such as validating commit messages, verifying author emails, confirming push permissions, and waiting for out-of-band approval. When the chain executes in the correct order, unauthorized changes are blocked before they reach the upstream remote.

In vulnerable versions, the ordering and completeness of these steps allowed an authenticated user to submit a push that skipped policy plugins and the explicit approval gate. Hidden or additional commits introduced during the push flow were not re-validated against the approval state, permitting content that had never been reviewed to reach the remote endpoint.

Root Cause

The root cause is an incorrect authorization sequence in the push pipeline. The checkIfWaitingAuth step ran before pack data was fully written and inspected, and no dedicated check existed to detect commits hidden inside the pushed pack. As a result, the authorization decision was made against an incomplete view of the change set.

Attack Vector

Exploitation requires an authenticated user with permission to initiate a push through GitProxy. The attacker crafts a push that includes additional or hidden commits beyond what was approved. Because the check for pending authorization completed before hidden commits were enumerated, the push proceeded to the upstream remote without triggering the review workflow.

typescript

// Patched pipeline in src/proxy/chain.ts
   proc.push.checkCommitMessages,
   proc.push.checkAuthorEmails,
   proc.push.checkUserPushPermission,
-  proc.push.checkIfWaitingAuth,
   proc.push.pullRemote,
   proc.push.writePack,
+  proc.push.checkHiddenCommits,
+  proc.push.checkIfWaitingAuth,
+  proc.push.getMissingData,
   proc.push.preReceive,
   proc.push.getDiff,
   // run before clear remote

Source: FINOS git-proxy commit a620a2f. The patch reorders the pipeline so checkIfWaitingAuth runs after writePack and adds checkHiddenCommits plus getMissingData to enumerate all commits before the authorization decision.

Detection Methods for CVE-2025-54583

Indicators of Compromise

Pushes recorded in the upstream Git remote that have no corresponding approval entry in the GitProxy audit log.
Commits appearing in protected branches whose author or content was never surfaced in the GitProxy approval UI.
GitProxy log entries showing checkIfWaitingAuth completing before writePack on the same push transaction.

Detection Strategies

Reconcile GitProxy approval records against upstream repository commit history and flag any push without a matching approval.
Enable secret scanning on downstream repositories to catch credentials that bypassed pre-push plugin checks.
Compare pack contents captured by GitProxy against the commits displayed to reviewers to detect hidden commits.

Monitoring Recommendations

Forward GitProxy application logs to a centralized log store and alert on approval-to-push mismatches.
Monitor the installed GitProxy version across all hosts and alert when a version below 1.19.2 is detected.
Track push volume per user and investigate anomalous spikes that may indicate bypass abuse.

How to Mitigate CVE-2025-54583

Immediate Actions Required

Upgrade FINOS GitProxy to version 1.19.2 or later on all proxy instances.
Audit upstream repositories for commits that landed during the exposure window without a matching approval record.
Rotate any secrets or credentials that may have been pushed through the proxy while it was vulnerable.

Patch Information

The vulnerability is fixed in FINOS GitProxy version 1.19.2. The upstream fixes are contained in commits a620a2f and bd2ecb2, and released in the v1.19.2 GitHub release. See the GitHub Security Advisory GHSA-qr93-8wwf-22g4 for full disclosure details.

Workarounds

Restrict GitProxy accounts to a minimal set of trusted users until the upgrade is deployed.
Enforce branch protection rules directly on the upstream Git provider so unreviewed pushes cannot land on protected branches.
Require server-side pre-receive hooks on the upstream remote to re-validate commit content independent of GitProxy.

bash

# Upgrade GitProxy to the patched release
npm install -g @finos/git-proxy@1.19.2

# Verify the installed version
git-proxy --version