SEC-2025-011 | .git Security Advisory

Executive Summary

The .git Security Engineering team has identified and resolved a Server-Side Request Forgery (SSRF) vulnerability in the git-proxy-connector module. This component is used to route outgoing Git operations through custom network proxies for enterprise environments.

An authenticated attacker with access to a workspace configuration could craft a malicious proxy URL pointing to internal resources, potentially leaking sensitive metadata or triggering unintended service-to-service calls. The vulnerability has been fully patched in version 2.3.5, and all managed instances have been automatically updated.

Technical Details

The vulnerability stems from insufficient validation of the PROXY_URL environment variable and configuration overrides. The connector failed to enforce strict allowlisting for internal IP ranges and loopback addresses, allowing crafted URLs to bypass DNS rebinding protections.

# Vulnerable configuration pattern
config:
  git_proxy:
    endpoint: "http://attacker-controlled-proxy.internal:8080"
    follow_redirects: true
    verify_ssl: false
            

The connector would forward authenticated Git requests through the specified endpoint without validating that the final resolved IP belonged to the expected proxy network. This allowed an attacker to pivot internal traffic to arbitrary hosts reachable from the runner environment.

Impact

Potential exposure of internal service metadata and DNS records
Unauthorized access to internal APIs exposed on private subnets
No user secrets, repository content, or cryptographic keys were at risk
Zero confirmed exploits in the wild. No customer data was compromised.

Mitigation & Remediation

All self-hosted and managed instances have been patched to v2.3.5. The fix implements:

Strict allowlisting for proxy hostnames and resolved IP ranges
Automatic rejection of loopback, link-local, and RFC 1918 addresses unless explicitly whitelisted
Redirect tracking with a maximum hop limit of 3 and strict origin validation
Forced TLS verification for all proxy endpoints

If you are running a custom deployment, update immediately:

# Docker / Kubernetes
docker pull git.dev/runner-proxy:v2.3.5

# Helm
helm upgrade git-proxy ./chart --set image.tag=v2.3.5
            

Timeline

Date (UTC)	Event
Jan 08, 2025	Vulnerability reported via HackerOne (#114829)
Jan 09, 2025	Confirmed & scoped by Security Team
Jan 12, 2025	Fix merged & regression tests passed
Jan 14, 2025	v2.3.5 released; automated rollout complete
Jan 15, 2025	Public advisory published

Acknowledgments

We thank 0xVortex for responsible disclosure and cooperation throughout the patching process. This vulnerability was discovered independently and was not part of any coordinated attack campaign.