Prototype Pollution in Webhook Configuration Parser Leading to Privilege Escalation

Summary

The .git security team has identified and resolved a High severity vulnerability in the webhook configuration parser used across the .git CLI and .git Cloud services. An attacker with access to craft webhook payloads could exploit prototype pollution to inject properties into the global object prototype, potentially leading to privilege escalation and unauthorized access to repository metadata.

This vulnerability affects .git CLI versions prior to 4.2.1 and all .git Cloud environments running the legacy webhook processor before the January 12, 2025 patch.

Technical Details

Vulnerability Description

The webhook configuration parser in lib/config/webhook-parser.js used an unsafe deep-merge utility that failed to sanitize object keys. By sending a crafted payload containing __proto__ or constructor.prototype keys, an attacker could modify the prototype of Object instances.

Specifically, injecting a role property into the prototype could cause subsequent configuration checks to incorrectly evaluate user permissions, granting elevated access.

{
  "webhook": {
    "url": "https://attacker.example.com/hook",
    "events": ["push"],
    "__proto__": {
      "role": "admin"
    }
  }
}

Impact

• Privilege Escalation: Attackers could potentially elevate standard user roles to administrative privileges in affected scopes.
• Data Leakage: Injected properties could expose sensitive environment variables or repository metadata.
• Service Disruption: Severe pollution could cause denial of service in the configuration service.

There is no evidence of exploitation in the wild. However, due to the critical nature of the impact, we are treating this as a high-priority patch.

Remediation

.git CLI Users

Update to the latest version immediately:

# Update via npm
npm update -g @git/cli

# Verify version.
git --version
# Expected: .git CLI v4.2.1 or later

.git Cloud Users

All .git Cloud instances have been patched automatically. No action is required for cloud users. However, we recommend rotating any webhook secrets as a precautionary measure.

# Regenerate webhook secret for a project
git webhook rotate --project <project-id>

# List active webhooks
git webhook list

Timeline

Acknowledgements

We sincerely thank Alex Chen (@0xd0ff) for responsibly reporting this vulnerability and working with our team to ensure a safe and coordinated release. Alex earned a reward through the .git Bug Bounty Program.

If you believe you have found a security vulnerability in .git, please report it to security@git.dev or via our Bug Bounty Program. We welcome responsible disclosure and offer rewards for valid reports.