github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-05-11 09:40:19 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

gitea remote command execution with default installation #2429

New Issue
Closed
opened 2025-11-02 04:35:49 -06:00 by GiteaMirror · 5 comments
GiteaMirror commented 2025-11-02 04:35:49 -06:00
Owner
Copy Link

Originally created by @5alt on GitHub (Oct 22, 2018).

  • Gitea version (or commit ref): current (9458880c06)

  • Can you reproduce the bug at https://try.gitea.io:

    • Yes (provide example URL)
    • [ x] No
    • Not relevant

Description

Hi, I found a issue just like https://github.com/gogs/gogs/issues/5469.
With gitea's default installation, I can authenticate as arbitrary account. But due to some server configuration, I can't reproduce in https://try.gitea.io .

As this is a very severe issue, I won't post details here. Can you give me your email address and I send the details to you?

Originally created by @5alt on GitHub (Oct 22, 2018). - Gitea version (or commit ref): current (https://github.com/go-gitea/gitea/commit/9458880c068c985692a49caf608f0057c73790bf) - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ x] No - [ ] Not relevant ## Description Hi, I found a issue just like https://github.com/gogs/gogs/issues/5469. With gitea's default installation, I can authenticate as arbitrary account. But due to some server configuration, I can't reproduce in https://try.gitea.io . As this is a very severe issue, I won't post details here. Can you give me your email address and I send the details to you?
GiteaMirror added the topic/security label 2025-11-02 04:35:49 -06:00
GiteaMirror commented 2025-11-02 04:35:50 -06:00
Author
Owner
Copy Link

@techknowlogick commented on GitHub (Oct 22, 2018):

@5alt thanks for report, security@gitea.io is the email address.

@techknowlogick commented on GitHub (Oct 22, 2018): @5alt thanks for report, security@gitea.io is the email address.
GiteaMirror commented 2025-11-02 04:35:50 -06:00
Author
Owner
Copy Link

@bugreport0 commented on GitHub (Oct 23, 2018):

If there's an app.ini / external way to mitigate this issue before an official patch is out, it might be worth sharing early so we can harden our installation(s). I don't want to interfere with any project security policy, but eventually the patch/commit will be public anyway.

@bugreport0 commented on GitHub (Oct 23, 2018): If there's an `app.ini` / external way to mitigate this issue before an official patch is out, it might be worth sharing early so we can harden our installation(s). I don't want to interfere with any project security policy, but eventually the patch/commit will be public anyway.
GiteaMirror commented 2025-11-02 04:35:50 -06:00
Author
Owner
Copy Link

@techknowlogick commented on GitHub (Oct 23, 2018):

The remote execution could be mitigated by setting DISABLE_GIT_HOOKS to true, however the account takeover is still a significant issue.

@techknowlogick commented on GitHub (Oct 23, 2018): The remote execution could be mitigated by setting `DISABLE_GIT_HOOKS` to true, however the account takeover is still a significant issue.
GiteaMirror commented 2025-11-02 04:35:51 -06:00
Author
Owner
Copy Link

@bugreport0 commented on GitHub (Oct 23, 2018):

@techknowlogick thanks! Account takeover is significant, but being able to prevent remote code execution right now is a huge deal.

@bugreport0 commented on GitHub (Oct 23, 2018): @techknowlogick thanks! Account takeover is significant, but being able to prevent remote code execution right now is a huge deal.
GiteaMirror commented 2025-11-02 04:35:51 -06:00
Author
Owner
Copy Link

@5alt commented on GitHub (Oct 26, 2018):

https://github.com/gogs/gogs/issues/5469#issuecomment-433280865

@5alt commented on GitHub (Oct 26, 2018): https://github.com/gogs/gogs/issues/5469#issuecomment-433280865
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label topic/security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#2429
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?