3 matches found
Gitea: Remote Code Execution via diffpatch Git Hook Installation
Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...
GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation
Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...
