New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Summary
A critical remote code execution vulnerability has been patched in Gitea, a self-hosted Git platform. The flaw allowed users with ordinary repository write access to execute arbitrary shell commands by manipulating patch content into a Git hook. The vulnerability is fixed in version 1.27.1.
IFF Assessment
This vulnerability allows attackers to execute arbitrary code on the server, posing a significant threat to Gitea instances and their associated data.
Severity
The CVSS score of 9.8 indicates a critical severity, primarily due to the attack vector being local (requiring repository write access) but allowing for network-exploitable remote code execution with high impact on confidentiality, integrity, and availability.
Defender Context
Defenders should ensure their Gitea instances are updated to version 1.27.1 or later to mitigate this critical RCE vulnerability. This highlights the ongoing risk of code execution flaws in self-hosted software and the importance of timely patching.