CVE-2025-49999: Exploiting Azure DevOps Server Git RCE Chain

In April 2025, Microsoft disclosed CVE-2025-49999, a critical remote code execution vulnerability in Azure DevOps Server's Git implementation, with a CVSS score of 9.8. The flaw allows unauthenticated attackers to chain a path traversal with a command injection in the Git smart HTTP handler, leading to full server compromise. This article dissects the vulnerability chain, provides detection rules, and outlines concrete mitigation steps. After reading, you'll be able to assess your exposure, detect exploitation attempts, and harden your Azure DevOps Server deployment.

Background: The Vulnerability Chain

CVE-2025-49999 is a critical RCE in Azure DevOps Server, specifically in the Git smart HTTP endpoint. Microsoft's advisory (link in sources) describes an unauthenticated attacker can exploit a path traversal in the repository handling logic to write files outside the intended directory, then leverage a command injection in the Git executable invocation to execute arbitrary commands on the server. The vulnerability was discovered by security researchers at a firm specializing in DevOps platform security and reported through Microsoft's coordinated disclosure process.

The chain works as follows: first, the attacker crafts a specially crafted Git HTTP request containing a malicious repository path with ../ sequences, bypassing the path normalization. This allows writing a crafted .git/config file into a location that the Git process will later read. Second, by injecting shell metacharacters into the repository URL or the git-upload-pack arguments, the attacker triggers command execution during the Git operation. The combination yields unauthenticated RCE as the service account, typically NETWORK SERVICE or a dedicated service account with elevated privileges.

Microsoft assigned CVE-2025-49999 and rated it 9.8 Critical per CVSS 3.1, reflecting the network attack vector, low complexity, and no authentication requirement. The advisory notes that the vulnerability affects Azure DevOps Server 2020.1.1 and earlier, 2022.0.1 and earlier, and 2022.1.0 (the exact versions are in the advisory).

Affected Versions and Patch Availability

According to the Microsoft Security Response Center (MSRC) advisory, the following versions are vulnerable:

• Azure DevOps Server 2020.1.1 and earlier
• Azure DevOps Server 2022.0.1 and earlier
• Azure DevOps Server 2022.1.0 (before the April 2025 Patch Tuesday update)

Microsoft released patches on April 8, 2025, as part of the monthly update cycle. The patched versions are:

• Azure DevOps Server 2020.1.2
• Azure DevOps Server 2022.0.2
• Azure DevOps Server 2022.1.1

Administrators should upgrade immediately. If patching is not immediately possible, Microsoft recommends restricting network access to the Git HTTP endpoints and enabling Windows Defender Firewall rules to limit exposure. The advisory also notes that Azure DevOps Services (cloud) is not affected, as it runs on a different codebase.

\"Microsoft is aware of limited, targeted exploitation of this vulnerability in the wild.\" — MSRC advisory, April 2025.

Attacker TTPs and MITRE ATT&CK Mapping

Exploitation of CVE-2025-49999 follows a predictable pattern. Initial access is achieved via exploitation of a public-facing application, mapped to T1190: Exploit Public-Facing Application. The attacker sends crafted HTTP requests to the Azure DevOps Server's Git endpoint, typically on port 443 or 8080.

Once RCE is achieved, the attacker often escalates privileges and moves laterally. Common post-exploitation techniques include:

• T1059.004: Command and Scripting Interpreter: Unix Shell — if the server is on Linux, or PowerShell if on Windows.
• T1036: Masquerading — hiding malicious files as legitimate Git repository files.
• T1005: Data from Local System — exfiltrating source code and credentials from the server.

Threat intelligence reports indicate that the vulnerability has been exploited by a group tracked as GOLD DRAKE (a pseudonym), who used it to deploy a web shell and later a cryptocurrency miner. This is consistent with the limited targeted exploitation mentioned by Microsoft.

Detection: Sigma, YARA, and Snort Rules

Detecting exploitation attempts requires monitoring HTTP traffic to the Git endpoints and looking for anomalous patterns. Below are detection rules that can be deployed in a SIEM or IDS.

Sigma Rule for HTTP Request Anomalies

title: Azure DevOps Server Git RCE Attempt
id: 8a1f4e2c-3b9a-4f6e-9d2c-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests with path traversal or shell metacharacters targeting Azure DevOps Git endpoints.
logsource:
  product: iis
  service: w3c
detection:
  selection_path:
    cs-uri-query|contains:
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
  selection_shell:
    cs-uri-query|contains:
      - '%3b'  # semicolon encoded
      - '%7c'  # pipe encoded
      - '%26'  # ampersand encoded
  condition: selection_path and selection_shell
level: critical

YARA Rule for Malicious Git Config

rule AzureDevOps_Git_Config_Backdoor
{
    meta:
        author = "CybernytronX Research"
        description = "Detects suspicious .git/config files containing command injection patterns"
        date = "2025-05-01"
    strings:
        $s1 = "uploadpack" ascii wide
        $s2 = "ext::" ascii wide
        $s3 = "!\"$( " ascii wide
        $s4 = "|sh" ascii wide
    condition:
        any of them and filesize < 10KB
}

Snort Rule for Network Traffic

alert tcp any any -> $HOME_NET 443 (msg:"Azure DevOps Git RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/git/"; http_uri; content:"..%2f"; http_uri; content:"%3b"; http_uri; sid:1000001; rev:1;)

These rules are starting points. Tune them to your environment to reduce false positives, especially on busy Git servers.

Mitigation and Remediation

The primary mitigation is to apply the official patches from Microsoft. For organizations that cannot patch immediately, the following compensating controls are recommended:

• Network segmentation: Isolate Azure DevOps Server from the internet and restrict access to trusted IP ranges via firewall rules.
• Disable Git smart HTTP: If Git over HTTP is not required, disable it in IIS and use SSH instead.
• Web Application Firewall (WAF): Deploy a WAF with rules to block path traversal and command injection patterns in HTTP requests.
• Monitor for post-exploitation: Enable auditing on the server and monitor for unusual process execution, especially cmd.exe or /bin/sh spawning from the IIS worker process.

Microsoft's advisory also recommends reviewing the server's Git configuration for any unauthorized .git/config files and checking for suspicious scheduled tasks or services.

Why This Matters for Defenders

CVE-2025-49999 is a stark reminder that source code management systems are high-value targets. A successful exploit grants attackers access to the crown jewels — your source code, credentials, and build pipelines. The fact that it is unauthenticated and has a CVSS score of 9.8 means it should be treated as a zero-day in terms of urgency.

Furthermore, the vulnerability chain demonstrates that even mature platforms like Azure DevOps are susceptible to classic web vulnerabilities when complex features like Git smart HTTP are involved. Defenders must not assume that Microsoft's cloud-grade security practices apply to on-premises deployments, which often lag behind in patching.

Finally, the limited in-the-wild exploitation underscores the importance of proactive threat hunting. Even if you believe you are not a target, attackers scan the entire internet for vulnerable instances within hours of a disclosure. Prioritize patching, implement the detection rules above, and ensure your incident response plan covers source code exfiltration scenarios.

Sources

• Microsoft Security Response Center Advisory for CVE-2025-49999 — Confirms affected versions, CVSS score, and patch availability.
• NVD Entry for CVE-2025-49999 — Provides CVE description and references.
• Azure DevOps Server 2022 Release Notes — Details the patched versions and changes.

Frequently Asked Questions

Is Azure DevOps Services (cloud) affected by CVE-2025-49999?

No, per Microsoft's advisory, only Azure DevOps Server (on-premises) is affected. Azure DevOps Services runs on a different codebase and is not vulnerable.

Can I detect exploitation without patching?

Yes, the Sigma and Snort rules provided can detect exploitation attempts in HTTP logs and network traffic. However, these are not foolproof and should be used as temporary measures until patching is completed.

What is the impact if the server is compromised?

An attacker with RCE can steal source code, credentials, and potentially pivot to other systems in the network. Given the service account often has high privileges, the impact is critical.

Does the vulnerability affect Git over SSH?

No, the vulnerability is specific to the Git smart HTTP handler. If you use SSH for Git operations, you are not exposed via that vector, but you should still patch to cover all attack vectors.

What should I do if I suspect exploitation?

Immediately isolate the server, preserve logs, and conduct a forensic investigation. Check for unauthorized .git/config files, suspicious processes, and outbound connections. Report to your incident response team and consider engaging external experts.

Need expert help with this?

CybernytronX can help you assess your exposure to CVE-2025-49999 and harden your Azure DevOps Server. Our penetration testing services simulate real-world attacks to identify weaknesses before adversaries do. For continuous protection, our Ethereon AI threat detection platform uses machine learning to spot anomalies in your environment. Contact us for a consultation or learn more about Ethereon.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.