Gitea LFS Authentication Bypass Vulnerability Allowing Unauthorized Access to Private Repositories

A vulnerability in Gitea versions 1.23.0 through 1.26.2 allows authenticated SSH users to bypass authentication for Git Large File Storage (LFS) operations. This flaw enables unauthorized read access to LFS objects in private repositories. The issue arises because the application fails to properly validate SSH LFS sub-verbs, allowing users to exploit the oversight and gain access to restricted content.

Impact

Exploitation of this vulnerability allows any authenticated SSH user to read LFS objects from any private repository on the Gitea instance, regardless of their actual permissions. This represents a significant breach of confidentiality, as it enables unauthorized access to private repository contents.

Reproduction

To reproduce this vulnerability, first ensure that SSH and LFS are enabled on the Gitea instance. Then, use an authenticated SSH user who does not have access to a private repository to request LFS authentication for that repository. The request will be denied, indicating a lack of authorization. Next, send a request with a malformed sub-verb to bypass the permission check. This will return a valid LFS token, which can then be used to download LFS objects from the private repository, successfully exploiting the vulnerability.

Remediation

Users are advised to upgrade to Gitea version 1.26.3 or later, where this vulnerability has been patched.