Gitea vulnerabilities
This exploit of the day is bundle of several ones all that have been patched in the latest release of Gitea.
Gitea is a web interface for git.
Both Gitea and Gogs - Which is also an open source git web interface intended for
private use gained a lot of attraction when Microsoft bought up Github and the
most hardcore Voluntaries programmers rushed to other servers in a pure
“Open Source shall remain open” spirit!
Gitea and Gogs are both also lightweight alternatives to Gitlab both written in the new programming language golang.
Patch:
We recommend that you update to the latest version of Gitea, all vulnerabilities
mentioned in this blog post has been patched by
developers in various pull requests on github.
Most interesting vulnerabilities
Remote code execution with mirror repository URL settings
This vulnerability allows an malicious third party to put a malicious remote git url which will lead to a remote code execution due to bad escaping of the user defined input. Better URL validation and escaping was added in pull requests #6593 and #6594
- cfg.Section("remote \"origin\"").Key("url").SetValue(addr)
- return cfg.SaveToIndent(configPath, "\t")
+ _, err = git.NewCommand("remote", "add", "origin", addr).RunInDir(repoPath)
+ return err
}
Release note v1.8.0
Two factor authentication bypass throw the API
Due to a poorly written API token authentication handling in the code base a malicious third party is able to send a fake OTP(one time password) API token and be granted access to the Gitea server.
Luckily this was solved in pull request #6676 with a patch being written to the modules/auth/auth.go and modules/context/api.go module
+ } else {
+ ctx.Data["IsApiToken"] = true
}
- ctx.Data["IsApiToken"] = true
// CheckForOTP validateds OTP
func (ctx *APIContext) CheckForOTP() {
otpHeader := ctx.Req.Header.Get("X-Gitea-OTP")
twofa, err := models.GetTwoFactorByUID(ctx.Context.User.ID)
if err != nil {
if models.IsErrTwoFactorNotEnrolled(err) {
return // No 2FA enrollment for this user
}
ctx.Context.Error(500)
return
}
ok, err := twofa.ValidateTOTP(otpHeader)
if err != nil {
ctx.Context.Error(500)
return
}
if !ok {
ctx.Context.Error(401)
return
}
}
Release note v1.8.0
Leaking sensitive information
Gitea was vulnerable to a Timing Attack which would allow a malicious third party to guess the correct Token based on
what time it takes for the application to load each request.
The following patch was committed in pull request #7364
- if header != "Bearer "+setting.Metrics.Token {
+ got := []byte(header)
+ want := []byte("Bearer " + setting.Metrics.Token)
+ if subtle.ConstantTimeCompare(got, want) != 1 {
ctx.Error(401)
return
}
Release note v1.9.0
Keep up to date and subscribe to our RSS feed!
External links:
Microsoft buys github for 7.5 billion
Gogs
Gitea on github
Golang
Gitea 1.9
Stay up to date with Vulnerability Management
and build cool things with our API
