GHSA-3h6c-c475-jm7v
Arbitrary Code Execution in Gitea
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | code.gitea.io/gitea | >= 1.1.0, < 1.12.6 | 1.12.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
The git hook feature in Gitea 1.1.0 through 1.12.5 allows for authenticated remote code execution.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-14144
- https://github.com/go-gitea/gitea/pull/13058
- https://github.com/go-gitea/gitea/commit/8fe8ab5cbf2977f3a01ea12361df2cd76dce3ea9
- https://docs.github.com/en/enterprise-server%402.19/admin/policies/creating-a-pre-receive-hook-script
- https://docs.github.com/en/[email protected]/admin/policies/creating-a-pre-receive-hook-script
- https://docs.gitlab.com/ee/administration/server_hooks.html
- https://github.com/PandatiX/CVE-2021-28378
- https://github.com/PandatiX/CVE-2021-28378#notes
- https://github.com/go-gitea/gitea
- https://github.com/go-gitea/gitea/releases
- https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution
- https://www.exploit-db.com/exploits/49571
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach…
- http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.html