Overview
The cybersecurity community has recently discovered a significant vulnerability in the Harness Open Source end-to-end developer platform. Identified as CVE-2025-58158, this flaw affects the git LFS server (Gitness) component of the platform. Given the widespread use of this software by developers around the world, the vulnerability has serious implications for numerous systems and applications.
The importance of this vulnerability lies in its potential for exploitation. A malicious, authenticated user with access to the Harness Gitness server API can craft an upload request, allowing them to write an arbitrary file to any location on the file system. This could potentially compromise the server, leading to data leakage or even a full system takeover.
Vulnerability Summary
CVE ID: CVE-2025-58158
Severity: High (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise, data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Harness Open Source | Versions prior to 3.3.0
How the Exploit Works
The exploit takes advantage of a flaw in the implementation of the upload git LFS file API. The vulnerability arises from improper sanitization of the upload path, which means an attacker can manipulate the path to write files to any location on the file system. A successful exploit could lead to unauthorized access and control of the server, paving the way for data theft or further system compromise.
Conceptual Example Code
A malicious user might exploit this vulnerability by sending a crafted HTTP request as follows:
POST /api/git-lfs/upload HTTP/1.1
Host: harness.example.com
Content-Type: application/json
Authorization: Bearer [auth_token]
{
"filename": "../../../../../../../etc/passwd",
"content": "malicious_content"
}In this hypothetical example, the attacker is attempting to overwrite the ‘/etc/passwd’ file, which is a crucial system file on Unix-based systems, with malicious content. If successful, this could give the attacker elevated privileges on the system.
Fix and Mitigation
Harness has released a patch for this vulnerability in version 3.3.0 of their Open Source platform. All users are strongly encouraged to update to this version or later to mitigate this vulnerability. If immediate patching is not possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation.