Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the ToHook function in services/webhook/general.go. This function is responsible for converting a webhook_model.Webhook object into an api.Hook object for API responses. During this conversion, it calls the HeaderAuthorization method on the webhook object. The HeaderAuthorization method, defined in models/webhook/webhook.go, decrypts the HeaderAuthorizationEncrypted field from the database using the server's secret key and returns the plaintext authorization header. The ToHook function then includes this plaintext header in the API response. This exposes sensitive webhook credentials (like Bearer tokens, Basic Auth credentials, or API keys) to any user with repository admin privileges, as they can list webhooks via the API and read the plaintext authorization headers set by other admins. The fix, found in commit c5b7c5053392935a6955c166947072953a39d113, redacts the authorization header from the API response by setting it to an empty string and instead provides a boolean field HasAuthorizationHeader to indicate the presence of a header without exposing its value.
webhook.ToHookservices/webhook/general.go
webhook.Webhook.HeaderAuthorizationmodels/webhook/webhook.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |