[Security] CSRF Vulnerability on API #2002

New Issue

GiteaMirror · 2025-11-02T04:20:44-06:00

GiteaMirror commented

2025-11-02 04:20:44 -06:00

Originally created by @ghost on GitHub (Jul 3, 2018).

Gitea version (or commit ref): every version with swagger api
Git version: not relevant
Operating system: not relevant
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

Screenshots

Originally created by @ghost on GitHub (Jul 3, 2018).  - Gitea version (or commit ref): every version with swagger api - Git version: not relevant - Operating system: not relevant - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: ## Description ## Screenshots

GiteaMirror added the topic/security label 2025-11-02 04:20:44 -06:00

GiteaMirror closed this issue

2025-11-02 04:20:45 -06:00

GiteaMirror commented

2025-11-02 04:20:46 -06:00

@lunny commented on GitHub (Jul 4, 2018):

Because Gitea's UI are also using some APIs, so the APIs support many authorizations(session is one of them). But have you found any missing permissions checking? Could you send a security email to security@gitea.io?

@lunny commented on GitHub (Jul 4, 2018): Because Gitea's UI are also using some APIs, so the APIs support many authorizations(session is one of them). But have you found any missing permissions checking? Could you send a security email to security@gitea.io?

GiteaMirror commented

2025-11-02 04:20:46 -06:00

@lunny commented on GitHub (Jul 6, 2018):

I think you are right. Maybe we should use different routes for UI and APIs.

@lunny commented on GitHub (Jul 6, 2018): I think you are right. Maybe we should use different routes for UI and APIs.

GiteaMirror commented

2025-11-02 04:20:46 -06:00

@techknowlogick commented on GitHub (Jul 6, 2018):

The way the WordPress API works is that if cookie auth is used (vs token auth), then a nonce has to be sent as well, the nonce is injected into the html template for JS to use and pass to the API and act as a second factor. (I've seen this approach in other implementations, it is just that WP is most well known)

Even if we did different routes for UI/API the UI ajax routes would still be affected.

More and more functionality is being built that uses the API (issue date, etc..) via the UI, and so we should work towards resolving the issue above.

@techknowlogick commented on GitHub (Jul 6, 2018): The way the WordPress API works is that if cookie auth is used (vs token auth), then a nonce has to be sent as well, the nonce is injected into the html template for JS to use and pass to the API and act as a second factor. (I've seen this approach in other implementations, it is just that WP is most well known) Even if we did different routes for UI/API the UI ajax routes would still be affected. More and more functionality is being built that uses the API (issue date, etc..) via the UI, and so we should work towards resolving the issue above.

GiteaMirror commented

2025-11-02 04:20:46 -06:00

@techknowlogick commented on GitHub (Jul 7, 2018):

Perhaps we could use the CSRF token as a second factor

@techknowlogick commented on GitHub (Jul 7, 2018): Perhaps we could use the CSRF token as a second factor

GiteaMirror commented

2025-11-02 04:20:46 -06:00

@techknowlogick commented on GitHub (Aug 9, 2018):

Anyone looking at this https://github.com/go-gitea/gitea/blob/master/routers/api/v1/api.go#L133 reqToken just validates that the user is signed in, not that they are using a valid token.

@techknowlogick commented on GitHub (Aug 9, 2018): Anyone looking at this https://github.com/go-gitea/gitea/blob/master/routers/api/v1/api.go#L133 `reqToken` just validates that the user is signed in, not that they are using a valid token.

GiteaMirror commented

2025-11-02 04:20:46 -06:00

@beeonthego commented on GitHub (Sep 1, 2018):

Is someone working on this issue now? if not, I will prepare a PR and check whether a token (or basic auth) has been used to authenticate. the check can be added to reqToken handler. There are a few minor changes, non breaking.

@beeonthego commented on GitHub (Sep 1, 2018): Is someone working on this issue now? if not, I will prepare a PR and check whether a token (or basic auth) has been used to authenticate. the check can be added to reqToken handler. There are a few minor changes, non breaking.

GiteaMirror referenced this issue

2025-11-02 12:04:00 -06:00

[PR #2002] [MERGED] Add integration test for issue creating #16175

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#2002