The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Gitea Gitea
cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*
|
1.18.0
|
28.1.0
|
References 5
https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g
GitHub Security Advisory GHSA-7v5j-mph8-9w6g
https://github.com/go-gitea/gitea/pull/39501
Fix: go-gitea/gitea pull request #39501
https://github.com/go-gitea/gitea/pull/39507
Fix backport to release/v28: go-gitea/gitea pull request #39507
https://blog.gitea.com/release-of-28.1.0/
Gitea 28.1.0 release announcement
https://github.com/go-gitea/gitea/releases/tag/v28.1.0
go-gitea/gitea v28.1.0 release