Gitea Actions Artifacts Signed URL HMAC Vulnerability Allowing Cross-Repository Read and Cross-Task Write

A vulnerability exists in Gitea versions 1.22.0 through 1.26.1, specifically within the Actions Artifacts V4 handling. The issue arises from the HMAC signature of signed upload and download URLs, which can be manipulated to access artifacts across different tasks and repositories. An attacker with permission to run a Gitea Actions job can exploit this by rewriting a signed URL for an artifact they control to read from another task or repository, or to write data into another task's artifact upload staging, including in private repositories.

Impact

Exploitation of this vulnerability allows for cross-repository artifact reading and cross-task artifact staging writing, along with unauthorized metadata modifications on the target artifact.

Reproduction

The vulnerability can be reproduced by creating a Gitea Actions authorization token and using it to request a signed URL for a target artifact. After obtaining the signed URL, it can be rewritten to access a different artifact in another repository or task, while preserving the original HMAC signature. This forged URL can then be used to download the artifact or upload data to a different task's artifact staging area.

Remediation

Users are advised to upgrade to Gitea version 1.26.2, where this vulnerability has been patched.