Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in multiple locations where Gitea performs HTTP requests to user-provided URLs without proper validation, leading to Server-Side Request Forgery (SSRF). The core of the issue is the use of Go's default http.Get or http.DefaultClient, which does not enforce any restrictions on the target host, allowing requests to internal services, cloud metadata endpoints, and local files via the file:// scheme.
The main fixing commit de4b8277e9cb576f2315fb03b5ab6478b42a1d31 addresses these issues by replacing the insecure HTTP requests with a client that uses Gitea's hostmatcher module for SSRF protection. This ensures that all outbound requests from these vulnerable code paths are validated against an allow/block list of hosts.
The identified vulnerable functions are the entry points where these insecure requests were being made:
uri.Open was the central utility function performing the raw http.Get.migrations.GiteaLocalUploader.CreateReleases and migrations.GiteaLocalUploader.updateGitForPullRequest in services/migrations/gitea_uploader.go used uri.Open for downloading migration assets and pull request patches.migrations.RepositoryDumper.CreateReleases and migrations.RepositoryDumper.handlePullRequest in services/migrations/dump.go performed similar downloads using a raw http.Get.auth.oauth2UpdateAvatarIfNeed in routers/web/auth/oauth.go fetched user avatars from external URLs without validation.By identifying these functions, we can create accurate runtime profiles to detect exploitation attempts of this vulnerability.
uri.Openmodules/uri/uri.go
migrations.GiteaLocalUploader.CreateReleasesservices/migrations/gitea_uploader.go
migrations.GiteaLocalUploader.updateGitForPullRequestservices/migrations/gitea_uploader.go
migrations.RepositoryDumper.CreateReleasesservices/migrations/dump.go
migrations.RepositoryDumper.handlePullRequestservices/migrations/dump.go
auth.oauth2UpdateAvatarIfNeedrouters/web/auth/oauth.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |