Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |
Miggo AIRoot Cause AnalysisThe vulnerability allows an attacker with administrative access to a repository to change its visibility from private to public without leaving any audit trail. This is achieved by using undocumented git push options, repo.private and repo.template. The vulnerability lies in the HookPostReceive function in routers/private/hook_post_receive.go, which is responsible for handling post-receive git hooks.
The analysis started by examining the provided vulnerability description, which clearly pointed to the affected file and function. The description also included a code snippet of the vulnerable part and a recommended fix. To find the exact commit that patched the vulnerability, I first tried to find a pull request linked to the security advisory, but the initial attempts were not successful. I then decided to compare the commits between the last vulnerable version and the first patched version. This led me to a large number of commits. To narrow down the search, I looked for a commit with a message related to the vulnerability, specifically mentioning "push options" and "visibility". This led me to the commit af7ba2edef3526975d975349487844b0e7e17d87.
Analyzing this commit confirmed that it contained the fix. The commit modified the hookPostReceiveUpdateRepoByOptions function (which is called by HookPostReceive) to only process the repo.private and repo.template push options if the repository is empty (!repo.IsEmpty). This prevents the exploit on existing repositories. The vulnerable functions identified are HookPostReceive as the entry point and hookPostReceiveUpdateRepoByOptions as the function containing the flawed logic. Both would appear in a runtime profile during exploitation.
HookPostReceiverouters/private/hook_post_receive.go
hookPostReceiveUpdateRepoByOptionsrouters/private/hook_post_receive.go