Gitea Unauthenticated Regular Expression Denial-of-Service Vulnerability in CODEOWNERS Processing

A denial-of-service vulnerability has been identified in Gitea versions prior to 1.26.2, allowing unauthenticated users to cause server hangs through malicious CODEOWNERS files. The issue arises from the CODEOWNERS feature's use of regular expressions for pattern matching, which can be exploited to create catastrophic backtracking scenarios. This vulnerability is triggered by pushing a CODEOWNERS file with a crafted pattern into a repository, then opening a pull request that includes a file named to exploit the regex matching process. The resulting backtracking can significantly delay the processing of the pull request, tying up database resources and causing the Gitea instance to become unresponsive.

Impact

Exploitation of this vulnerability can lead to a significant slowdown in pull request processing times, with delays of over 30 seconds per request. This slowdown can be compounded by opening multiple pull requests in parallel, potentially exhausting the database connection pool and causing the Gitea instance to become unresponsive to all users.

Reproduction

The vulnerability can be reproduced by creating a repository and pushing a CODEOWNERS file containing a backtracking pattern, such as repeated 'a' characters followed by a non-matching character, into the default branch. Afterward, a pull request can be opened from a branch that includes a file named with a crafted filename that triggers the regex backtracking. This process can be automated with a script that logs into Gitea, creates the repository, uploads the malicious CODEOWNERS file, and opens the pull request, simulating the attack.

Remediation

Users are advised to upgrade to Gitea version 1.26.4, which includes a fix for this vulnerability by bounding the regex matching time to prevent denial-of-service.