github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-18 06:03:09 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Open redirect vulnerability on 2FA #1968

New Issue
Closed
opened 2025-11-02 04:19:39 -06:00 by GiteaMirror · 4 comments
GiteaMirror commented 2025-11-02 04:19:39 -06:00
Owner
Copy Link

Originally created by @glitch003 on GitHub (Jun 25, 2018).

  • Gitea version (or commit ref): 1.4.1
  • Git version: 2.17.1
  • Operating system: Ubuntu 16
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist: N/A

Description

This bug was submitted via a Bug Bounty program my company has, and I'd love to hear your thoughts on it

During the login process when the victim has entered his/her password and is then redirected to the page where he/she is told to enter his 2FA Code at this point the attacker will send a crafted link "https://try.gitea.io/user/login?redirect_to=//google.com/"

This crafted link will send this to same page he/she was viewing before and he/she will think it is a legitimate page is being loaded from "try.gitea.io"

Now they will enter there 2FA code there and will then be redirected on google.com or any other web page the attacker wants.

More info about open redirect vulnerabilities and why they're a problem:

Reproduction

You must have 2FA enabled on your account.

  1. Login at https://try.gitea.io/
  2. You will be redirected to "https://try.gitea.io/user/two_factor"
  3. Open this link "https://try.gitea.io/user/login?redirect_to=//google.com/"
  4. Enter the 2FA Code
  5. You will be redirected to google.com
Originally created by @glitch003 on GitHub (Jun 25, 2018). <!-- 1. Please speak English, this is the language all of us can speak and write. 2. Please ask questions or configuration/deploy problems on our Discord server (https://discord.gg/NsatcWJ) or forum (https://discourse.gitea.io). 3. Please take a moment to check that your issue doesn't already exist. 4. Please give all relevant information below for bug reports, because incomplete details will be handled as an invalid report. --> - Gitea version (or commit ref): 1.4.1 - Git version: 2.17.1 - Operating system: Ubuntu 16 - Database (use `[x]`): - [X] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [X] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: N/A ## Description **This bug was submitted via a Bug Bounty program my company has, and I'd love to hear your thoughts on it** During the login process when the victim has entered his/her password and is then redirected to the page where he/she is told to enter his 2FA Code at this point the attacker will send a crafted link "https://try.gitea.io/user/login?redirect_to=//google.com/" This crafted link will send this to same page he/she was viewing before and he/she will think it is a legitimate page is being loaded from "try.gitea.io" Now they will enter there 2FA code there and will then be redirected on google.com or any other web page the attacker wants. More info about open redirect vulnerabilities and why they're a problem: * http://cwe.mitre.org/data/definitions/601.html * https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet ## Reproduction You must have 2FA enabled on your account. 1. Login at https://try.gitea.io/ 2. You will be redirected to "https://try.gitea.io/user/two_factor" 3. Open this link "https://try.gitea.io/user/login?redirect_to=//google.com/" 4. Enter the 2FA Code 5. You will be redirected to google.com
GiteaMirror added the topic/security label 2025-11-02 04:19:39 -06:00
GiteaMirror commented 2025-11-02 04:19:40 -06:00
Author
Owner
Copy Link

@jonasfranz commented on GitHub (Jun 25, 2018):

Normal login without 2FA is also affected if //example.com is used.

@jonasfranz commented on GitHub (Jun 25, 2018): Normal login without 2FA is also affected if ``//example.com`` is used.
GiteaMirror commented 2025-11-02 04:19:40 -06:00
Author
Owner
Copy Link

@glitch003 commented on GitHub (Jun 26, 2018):

Wow that was fast, thanks all!

@glitch003 commented on GitHub (Jun 26, 2018): Wow that was fast, thanks all!
GiteaMirror commented 2025-11-02 04:19:40 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Jun 27, 2018):

Thanks @cezar97

@lunny commented on GitHub (Jun 27, 2018): Thanks @cezar97
GiteaMirror commented 2025-11-02 04:19:40 -06:00
Author
Owner
Copy Link

@sapk commented on GitHub (Jun 28, 2018):

The check introduce in #4312 should be introduce globaly in 7b2b900e13/modules/context/context.go (L80)
Or display a webpage in between the redirect that show the user he is leaving.

@sapk commented on GitHub (Jun 28, 2018): The check introduce in #4312 should be introduce globaly in https://github.com/go-gitea/gitea/blob/7b2b900e13612f565051c64374b788b0c8a82751/modules/context/context.go#L80 Or display a webpage in between the redirect that show the user he is leaving.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label topic/security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#1968
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?