Pre-Authentication Token Leakage in .git Deploy Agent

Vulnerability Overview

The vulnerability stems from an improper validation sequence in the X-Git-Deploy-Token header during the pre-flight TLS handshake. Under specific network conditions, the daemon would log and temporarily cache incoming tokens in a world-readable memory buffer before cryptographic validation completed. An attacker with adjacent network access could potentially intercept valid authentication material.

Impact Assessment

Successful exploitation does not grant direct access to source code repositories or CI/CD pipeline configurations. However, it may allow unauthorized deployment triggering, environment variable inspection, or pipeline status manipulation. Our threat intelligence team has confirmed zero indicators of compromise across the .git network.

Remediation

Upgrade to v3.4.2 or later immediately. The patch implements strict header validation, removes temporary buffer caching, and enforces constant-time comparison.

npm i @git/deploy-agent@latest

For enterprise managed installations:

git deploy-agent upgrade --force --version 3.4.2

Important: All tokens issued prior to March 10, 2025, have been automatically invalidated and rotated. You may need to update your CI/CD environment variables once following the upgrade. Service disruption is not expected.

Timeline

Report a Vulnerability