Harness permet une écriture de fichier arbitraire dans le serveur Gitness LFS dans github.com/harness/gitness

The Arbitrary File Access vulnerability in Harness Gitness poses a significant threat. An attacker could leverage this flaw to upload malicious files, such as web shells, to the server. Successful exploitation could grant the attacker remote code execution capabilities, allowing them to take complete control of the Gitness instance and potentially the underlying infrastructure. The attacker could also modify critical configuration files, leading to data breaches or denial of service. The ability to write arbitrary files bypasses standard security controls, making this a particularly dangerous vulnerability.

Organizations using Harness Gitness for Git repository management are at risk, particularly those running older, unpatched versions. Shared hosting environments where multiple users have access to the Gitness instance are especially vulnerable, as a compromised user account could be used to exploit this vulnerability.

• go / server: Monitor Gitness logs for unusual file creation events, especially in unexpected directories. Use journalctl -u gittess to filter for file access logs. • generic web: Check for unexpected files appearing in the Gitness LFS storage directory. Use curl -I <gitness_url>/lfs/ to check for directory listing exposure (disable if present). • generic web: Review access logs for requests attempting to write files to unusual locations. Use grep -i 'PUT /lfs/' /var/log/apache2/access.log (adjust path as needed).

1. 2025-09-17Disclosure

   disclosure

1. Réservé2025-08-27
2. Publiée2025-09-17
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-58158 is to immediately upgrade to version 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13 or later. Before upgrading, it is crucial to review the release notes for any breaking changes and plan a rollback strategy if necessary. While a direct workaround isn't available, restricting file write permissions on the Gitness server can reduce the potential impact. Implement robust input validation and sanitization to prevent malicious file uploads. Monitor Gitness logs for any suspicious file creation or modification activities.