CVE-2025-58355 in soft-serve
Summary
by MITRE • 09/04/2025
Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2025
The vulnerability identified as CVE-2025-58355 affects Soft Serve, a command-line self-hostable Git server that provides Git repository hosting capabilities through SSH interfaces. This security flaw exists in versions 0.9.1 and earlier, where the application fails to properly validate user input when processing SSH API requests. The vulnerability stems from insufficient sanitization of data passed through the SSH interface, allowing malicious actors to exploit this weakness to manipulate the file system. The issue specifically manifests when users attempt to create or override files on the server, potentially leading to arbitrary code execution or data corruption. This type of vulnerability falls under the category of path traversal or file manipulation flaws, which are commonly classified as CWE-22 (Path Traversal) or CWE-73 (External Control of File Name or Path) in the Common Weakness Enumeration framework. The SSH API functionality in Soft Serve appears to process repository operations without adequate validation of the file paths or content being submitted by remote users.
The technical implementation of this vulnerability allows attackers to submit specially crafted commands through the SSH interface that bypass normal file system access controls. When the Git server processes these requests, it fails to properly sanitize the input data, enabling attackers to specify arbitrary file paths that can result in the creation of new files or overwriting of existing system files. The vulnerability essentially allows for a form of privilege escalation where remote unauthenticated users can manipulate the file system to achieve unauthorized access or modify critical system components. This weakness is particularly concerning in a Git server context because Git repositories often contain sensitive code, configuration files, and potentially credentials that could be compromised through such an attack vector. The exploitation of this vulnerability could lead to complete system compromise, especially if the Git server runs with elevated privileges or if the affected system contains sensitive information within the repository structure.
The operational impact of CVE-2025-58355 extends beyond simple file manipulation, as it represents a critical security weakness that could enable attackers to gain persistent access to the underlying system. Attackers could potentially use this vulnerability to plant backdoors, modify system binaries, or corrupt repository data, leading to service disruption or data loss. The vulnerability affects organizations that rely on self-hosted Git solutions for version control, particularly those with limited security monitoring capabilities. Given that SSH is a common interface for Git operations, this vulnerability could be exploited by attackers who have gained access to the SSH service or who can perform reconnaissance to identify vulnerable installations. The risk is compounded by the fact that this vulnerability affects a self-hosted solution, meaning that organizations may not be aware of the specific version they are running or may not have proper patch management processes in place. This vulnerability also aligns with ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1566.001 (Phishing: Spearphishing Attachment) in scenarios where attackers might leverage the Git server as a foothold for further compromise. Organizations using Soft Serve should immediately implement mitigation strategies including patching to version 0.10.0 or higher, implementing SSH key restrictions, and monitoring for unusual file system modifications. Additionally, network segmentation and access controls should be enforced to limit potential exploitation of this vulnerability. The fix in version 0.10.0 addresses the core issue by implementing proper input validation and sanitization of file paths submitted through the SSH API, ensuring that only legitimate repository operations can be performed through the interface.