Harness Ermöglicht Willkürliches Schreiben von Dateien im Gitness LFS Server in github.com/harness/gitness

The Arbitrary File Access vulnerability in Harness Gitness poses a significant threat. An attacker exploiting this flaw could write malicious files to sensitive locations on the server, such as overwriting configuration files or injecting malicious code into executable files. Successful exploitation could lead to complete system compromise, allowing the attacker to gain unauthorized access to data, execute arbitrary commands, and potentially pivot to other systems within the network. The ability to write arbitrary files bypasses typical access controls, making this a particularly dangerous vulnerability. The impact is amplified if Gitness is deployed in a shared hosting environment or integrated with other critical systems.

Organizations using Harness Gitness for Git repository management are at risk, particularly those running older, unpatched versions. Shared hosting environments where multiple users have access to the Gitness instance are especially vulnerable, as a compromised user account could be used to exploit this vulnerability.

• go / server: Monitor Gitness logs for unusual file creation events, especially in unexpected directories. Use journalctl -u gittess to filter for file access logs. • generic web: Check for unexpected files appearing in the Gitness LFS storage directory. Use curl -I <gitness_url>/lfs/ to check for directory listing exposure (disable if present). • generic web: Review access logs for requests attempting to write files to unusual locations. Use grep -i 'PUT /lfs/' /var/log/apache2/access.log (adjust path as needed).

1. 2025-09-17Disclosure

   disclosure

1. Reserviert2025-08-27
2. Veröffentlicht2025-09-17
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-58158 is to immediately upgrade to version 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13 or later. Before upgrading, it is crucial to review the release notes for any breaking changes and test the upgrade in a non-production environment. If a direct upgrade is not feasible due to compatibility issues, consider implementing stricter file access controls on the Gitness server to limit the potential impact of the vulnerability. While not a complete fix, restricting write access to specific directories can reduce the attack surface. After upgrading, verify the fix by attempting to write a file to a restricted location and confirming that the operation is denied.