Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-18926

CVE-2018-18926: Gitea Remote Code Execution (RCE)

9.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-18926
GHSA ID
GHSA-hf6f-jq25-8gq9
EPSS Score
0.91058%
CWE
CWE-94
Published
2/15/2022
Updated
9/15/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
code.gitea.io/giteago< 1.5.21.5.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper session ID validation in go-macaron/session components. The commit diff shows critical changes to session.go's read() function (added session ID format validation) and file.go's handling (UUID validation). These functions directly process untrusted session IDs, and their pre-patch versions lacked the necessary checks to prevent malicious session ID exploitation, enabling deserialization attacks. The CWE-94 classification and RCE impact confirm this relates to code injection via uncontrolled session ID input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*it** ***or* *.*.* *llows r*mot* *o** *x**ution ****us* it *o*s not prop*rly v*li**t* s*ssion I*s. T*is is r*l*t** to s*ssion I* **n*lin* in t** *o-m***ron/s*ssion *o** *or M***ron.

Reasoning

T** vuln*r**ility st*ms *rom improp*r s*ssion I* v*li**tion in `*o-m***ron/s*ssion` *ompon*nts. T** *ommit *i** s*ows *riti**l ***n**s to `s*ssion.*o`'s `r***()` *un*tion (***** s*ssion I* *orm*t v*li**tion) *n* `*il*.*o`'s **n*lin* (UUI* v*li**tion)