Gitea HTTP Redirect Vulnerability Leading to Server-Side Request Forgery

A server-side request forgery (SSRF) vulnerability has been identified in Gitea versions through 1.25.4, specifically within the repository migration feature. The issue arises when a user migrates a repository from an external URL. Gitea correctly blocks direct imports from internal addresses. However, if the initial URL redirects to an internal service, Gitea follows the redirect without revalidating the destination. This flaw allows a low-privilege user to access internal services via Gitea as a proxy, potentially exfiltrating sensitive data or interacting with internal systems.

Impact

Exploitation of this vulnerability allows authenticated users with repository creation permissions to access and exfiltrate data from internal services that are only available on the Gitea server or its local network. This could include private Git repositories, cloud metadata endpoints that provide temporary credentials, internal APIs, CI/CD systems, databases, or other services that trust connections from the Gitea server.

Reproduction

To reproduce this vulnerability, a low-privilege Gitea user must register an account and generate an API token with repository write permissions. The vulnerability can be exploited by sending a migration request to the Gitea server, using the attacker-controlled server's URL that redirects to an internal service. Gitea will follow the redirect, bypassing its internal address validation, and the attacker can then access the internal service through the migrated repository.

Remediation

Users are advised to upgrade to Gitea version 1.26.4, which addresses this vulnerability by blocking HTTP redirects during repository migration that could lead to internal addresses.