Gna
/
website
2
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

new deploy: 2022-10-25T09:23:47+00:00

pages
Loïc Dachary 2022-10-25 09:23:47 +00:00 committed by dachary
parent 86eb18b6c3
commit f57bb9ab9d
18 changed files with 813 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

338
blog/1-17-2-migration-security/index.html Normal file
View File

@ -0,0 +1,338 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width" />
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
<link rel="manifest" href="/site.webmanifest" />
<link rel="me" href="https://pouet.chapril.org/@gna" />
<link rel="stylesheet" href="https://gna.org/main.css" />
<link
rel="stylesheet"
media="screen and (max-width: 1300px)"
href="https://gna.org/mobile.css"
/>
<meta name="referrer" content="no-referrer-when-downgrade" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="stylesheet" href="https://gna.org/main.css" />
<link
rel="stylesheet"
media="screen and (max-width: 1300px)"
href="https://gna.org/mobile.css"
/>
<meta name="referrer" content="no-referrer-when-downgrade" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained | Gna!: Managed Gitea Hosting </title>
<meta name="referrer" content="no-referrer-when-downgrade" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="description" content="Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API." />
<meta property="og:title" content="[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained | Gna!: Managed Gitea Hosting " />
<meta property="og:type" content="article" />
<meta property="og:url" content="https:&#x2F;&#x2F;gna.org" />
<meta property="og:description" content="Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API." />
<meta
property="og:site_name"
content="[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained | Gna!: Managed Gitea Hosting "
/>
<link
rel="apple-touch-icon"
sizes="57x57"
href="https://gna.org/apple-icon-57x57.png?h=c21de14cfdf862a6472ae977557fa048a7c36d39337e61d3274705e9bd8e857f"
/>
<link
rel="apple-touch-icon"
sizes="60x60"
href="https://gna.org/apple-icon-60x60.png?h=67089d9025a52d0d1ddce450078c7acefe2c150a2427dec9f5e13c6314f74281"
/>
<link
rel="apple-touch-icon"
sizes="72x72"
href="https://gna.org/apple-icon-72x72.png?h=70725943de8884804f9da28202ced0ad6fed483ae9cf8f6d874aa133e30cb693"
/>
<link
rel="apple-touch-icon"
sizes="76x76"
href="https://gna.org/apple-icon-76x76.png?h=1e6e8072df3b21bdcea254a42aac6e993611e845f91ddd79f6f35a6c441710a5"
/>
<link
rel="apple-touch-icon"
sizes="114x114"
href="https://gna.org/apple-icon-114x114.png?h=c20099f8190ed3962fab5726c5594857a871cdb3ee98439343c622cd3727fed6"
/>
<link
rel="apple-touch-icon"
sizes="120x120"
href="https://gna.org/apple-icon-120x120.png?h=4df78e402e60b58c6d44764678bdd737b5b6a836aeb85fb75fa49f706f7e8c81"
/>
<link
rel="apple-touch-icon"
sizes="144x144"
href="https://gna.org/apple-icon-144x144.png?h=0c44e6655d714f89ee95cc151032d1f0dc3204bd24d1ca2ee9d94692d4ede84d"
/>
<link
rel="apple-touch-icon"
sizes="152x152"
href="https://gna.org/apple-icon-152x152.png?h=157918f883ff95d4eeb6452d0ebb61ca5e21ea0dcac1aefe825f3e2f3999052f"
/>
<link
rel="apple-touch-icon"
sizes="180x180"
href="https://gna.org/apple-icon-180x180.png?h=7d5c16d379b7db6d8ea5aae64921d7162b84f543763acd8fc7c107f80a600213"
/>
<link
rel="icon"
type="image/png"
sizes="192x192"
href="https://gna.org/android-icon-192x192.png?h=095e3835b082dba07f606c33fa6f71bcd671a71e987b0ab2e46dcddceef52b9c"
/>
<link
rel="icon"
type="image/png"
sizes="32x32"
href="https://gna.org/favicon-32x32.png?h=1bf54bf111572b1d1639192b5360ee4345f702e563aa71bb66610a95a7290437"
/>
<link
rel="icon"
type="image/png"
sizes="96x96"
href="https://gna.org/favicon-96x96.png?h=5a6ed96c09f5055526e3b236867a1272a26f7ba957d48b267bccd51ef0845fbe"
/>
<link
rel="icon"
type="image/png"
sizes="16x16"
href="https://gna.org/favicon-16x16.png?h=1e5fa59ae78516055f662e40bb2599dc3828a7adb34567e9d8d2cfcaa6b7aa5f"
/>
<link
rel="manifest"
href="https://gna.org/manifest.json?h=27eca3e8297eb7ff340deb3849b210185a459b3845456aa4d0036f6d966b3518"
/>
<meta name="msapplication-TileColor" content="#ffffff" />
<meta
name="msapplication-TileImage"
content="https://gna.org/ms-icon-144x144.png?h=8170ab51b871b84b8f98bd03cf441afdffb2998b7dfffb04abb7ebf5deeb1f94"
/>
<meta name="theme-color" content="#ffffff" />
</head>
</head>
<body class="base">
<header>
<nav class="nav__container">
<input type="checkbox" class="nav__toggle" id="nav__toggle" />
<div class="nav__header">
<a class="nav__logo-container" href="/">
<img src="https://gna.org/gna-logo-rectangle-48px.png?h=ba9eab043277265f94c51b87d5e14f9ca35789403ecb8afc9bd1e33b13c6a2a5" alt="Gna!"/>
</a>
<label class="nav__hamburger-menu" for="nav__toggle">
<span class="nav__hamburger-inner"></span>
</label>
</div>
<div class="nav__spacer--small"></div>
<div class="nav__link-group">
<div class="nav__link-container">
<a class="nav__link" rel="noreferrer" href="&#x2F;about&#x2F;">About</a>
</div>
<div class="nav__link-container">
<a class="nav__link" rel="noreferrer" href="&#x2F;blog&#x2F;">Blog</a>
</div>
<div class="nav__link-container">
<a class="nav__link" rel="noreferrer" href="https:&#x2F;&#x2F;matrix.to&#x2F;#&#x2F;#gna:matrix.batsense.net">Chat</a>
</div>
<div class="nav__link-container">
<a class="nav__link" rel="noreferrer" href="&#x2F;gitea-clinic&#x2F;">Clinic</a>
</div>
<div class="nav__link-container">
<a class="nav__link" rel="noreferrer" href="https:&#x2F;&#x2F;forum.gna.org">Forum</a>
</div>
<div class="nav__link-container">
<a class="nav__link" rel="noreferrer" href="https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna">Mastodon</a>
</div>
</div>
<div class="nav__spacer"></div>
<div class="nav__link-group--small">
<div class="nav__link-container">
<a class="nav__link" rel="noreferrer" href="https:&#x2F;&#x2F;hosteadashboard.gna.org&#x2F;login&#x2F;">Login</a>
</div>
<div class="nav__link-container--action">
<a class="nav__link" rel="noreferrer" href="https:&#x2F;&#x2F;hosteadashboard.gna.org&#x2F;register&#x2F;">Join</a>
</div>
</div>
</nav>
</header>
<!-- See ../sass/main.scss. Required for pushing footer to the very
bottom of the page -->
<div class="main__content-container">
<main>
<div class="page__container">
<h1 class="page__group-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h1>
<p class="blog__post-meta">
<a href="https:&#x2F;&#x2F;dachary.org" class="post__author">Loïc Dachary</a>
&middot; 24
October
,
2022 &middot; <b>2 min read</b>
</p>
<div class="blog__content">
<p><a href="https://pouet.chapril.org/@gna/108953815492944898">Gitea 1.17.2</a> includes a <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/commit/e6b3be460840f1f982d5358198466e7d6f509d21">security patch</a> that prevents bypassing URL restrictions during the migration of a remote repository.</p>
<p>When using the web interface or the REST API to <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/blob/upstream/routers/api/v1/repo/migrate.go#L209-212">import / migrate a repository</a> that exists on another forge, the URL of the remote forge is <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/blob/9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb/routers/api/v1/repo/migrate.go#L109">verified</a> and rejected if not allowed. For instance if it starts with <strong>file://</strong>, contains <strong>%0c</strong> <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/blob/9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb/services/migrations/migrate.go#L43">and more</a>.</p>
<p>The migration then starts by <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/blob/9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb/services/migrations/migrate.go#L185">asking for more information</a> about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.</p>
<p>For instance, when migrating a project from another Gitea instance, the Gitea migration driver <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/blob/9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb/services/migrations/gitea_downloader.go#L153">calls the GetRepo</a> function of the Gitea SDK, which returns the result of the <a href="https://try.gitea.io/api/swagger#/repository/repoGet">/repos/{owner}/{repo}</a> endpoint verbatim.</p>
<p>If a malicious server is setup by an adversary so that the <strong>/repos/{owner}/{repo}</strong> enpoint returns a URL designed to leak information from the server such as <strong>file:///etc/group</strong>, it should also be verified and discarded. This is the purpose of the <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/blob/9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb/services/migrations/migrate.go#L201-220">check that was added</a> in Gitea 1.17.2.</p>
<pre data-lang="go" style="background-color:#2b303b;color:#c0c5ce;" class="language-go "><code class="language-go" data-lang="go"><span> </span><span style="color:#65737e;">// SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
</span><span> </span><span style="color:#b48ead;">if </span><span style="color:#bf616a;">_</span><span>, </span><span style="color:#bf616a;">ok </span><span>:= </span><span style="color:#bf616a;">downloader</span><span>.(*</span><span style="color:#b48ead;">RepositoryRestorer</span><span>); !</span><span style="color:#bf616a;">ok </span><span>{
</span><span> </span><span style="color:#65737e;">// Now the clone URL can be rewritten by the downloader so we must recheck
</span><span> </span><span style="color:#b48ead;">if </span><span style="color:#bf616a;">err </span><span>:= </span><span style="color:#bf616a;">IsMigrateURLAllowed</span><span>(</span><span style="color:#bf616a;">repo</span><span>.</span><span style="color:#bf616a;">CloneURL</span><span>, </span><span style="color:#bf616a;">doer</span><span>); </span><span style="color:#bf616a;">err </span><span>!= </span><span style="color:#d08770;">nil </span><span>{
</span><span> </span><span style="color:#b48ead;">return </span><span style="color:#bf616a;">err
</span><span> }
</span><span>
</span><span> </span><span style="color:#65737e;">// SECURITY: Ensure that we haven&#39;t been redirected from an external to a local filesystem
</span><span> </span><span style="color:#65737e;">// Now we know all of these must parse
</span><span> </span><span style="color:#bf616a;">cloneAddrURL</span><span>, </span><span style="color:#bf616a;">_ </span><span>:= </span><span style="color:#bf616a;">url</span><span>.</span><span style="color:#bf616a;">Parse</span><span>(</span><span style="color:#bf616a;">opts</span><span>.</span><span style="color:#bf616a;">CloneAddr</span><span>)
</span><span> </span><span style="color:#bf616a;">cloneURL</span><span>, </span><span style="color:#bf616a;">_ </span><span>:= </span><span style="color:#bf616a;">url</span><span>.</span><span style="color:#bf616a;">Parse</span><span>(</span><span style="color:#bf616a;">repo</span><span>.</span><span style="color:#bf616a;">CloneURL</span><span>)
</span><span>
</span><span> </span><span style="color:#b48ead;">if </span><span style="color:#bf616a;">cloneURL</span><span>.</span><span style="color:#bf616a;">Scheme </span><span>== &quot;</span><span style="color:#a3be8c;">file</span><span>&quot; || </span><span style="color:#bf616a;">cloneURL</span><span>.</span><span style="color:#bf616a;">Scheme </span><span>== &quot;&quot; {
</span><span> </span><span style="color:#b48ead;">if </span><span style="color:#bf616a;">cloneAddrURL</span><span>.</span><span style="color:#bf616a;">Scheme </span><span>!= &quot;</span><span style="color:#a3be8c;">file</span><span>&quot; &amp;&amp; </span><span style="color:#bf616a;">cloneAddrURL</span><span>.</span><span style="color:#bf616a;">Scheme </span><span>!= &quot;&quot; {
</span><span> </span><span style="color:#b48ead;">return </span><span style="color:#bf616a;">fmt</span><span>.</span><span style="color:#bf616a;">Errorf</span><span>(&quot;</span><span style="color:#a3be8c;">repo info has changed from external to local filesystem</span><span>&quot;)
</span><span> }
</span><span> }
</span><span>
</span><span> </span><span style="color:#65737e;">// We don&#39;t actually need to check the OriginalURL as it isn&#39;t used anywhere
</span><span> }
</span></code></pre>
</div>
<br>
<br>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</div>
</main>
<footer>
<div class="footer__container">
<!-- <div class="footer__column"> --->
<p class="footer__column license__conatiner">
All text <a
class="license__link"
rel="noreferrer"
href="http://creativecommons.org/licenses/by-sa/4.0/"
target="_blank"
>&nbsp;CC-BY-SA&nbsp;</a
>
&amp; code
<a
class="license__link"
rel="noreferrer"
href="https://www.gnu.org/licenses/agpl-3.0.en.html"
target="_blank"
>&nbsp;AGPL&nbsp;</a
>
|
<a
class="license__link"
rel="noreferrer"
href="https://www.eff.org/issues/do-not-track/amp/"
target="_blank"
>&nbsp;No AMP&nbsp;</a
>
</p>
<!-- </div> -->
<div class="footer__column--center">
<a href="/blog/atom.xml" target="_blank" rel="noopener" title="RSS">
<img
src="https://gna.org/icons/rss.svg?h=f6cd584bdbcd2eb4d1b8b84c9cf083ef45f772167c33fdcee754b35ae8ff4c7d"
class="footer__icon"
alt="Email icon"
/>
</a>
</div>
<div class="footer__column">
<a href="/about" title="About">About</a>
<a href="/coc" title="Code of Conduct">CoC</a>
<span class="footer__column-divider--mobile-only">|</span>
<a href="/legalese" title="Legalese">Legalese</a>
<a href="/privacy-policy" title="Privacy Policy">Privacy</a>
<span class="footer__column-divider--mobile-only">|</span>
<a
href="https://gitea.gna.org/Gna"
rel="noreferrer"
target="_blank"
title="Status"
>Source Code</a
>
<a href="/tos" title="Terms of Service">ToS</a>
</div>
</div>
</footer>
</div>
</body>
</html>

36
blog/atom.xml
View File

@ -4,8 +4,42 @@
<link href="https://gna.org/blog/atom.xml" rel="self" type="application/atom+xml"/>
<link href="https://gna.org/blog/"/>
<generator uri="https://www.getzola.org/">Zola</generator>
<updated>2022-10-17T00:00:00+00:00</updated>
<updated>2022-10-24T00:00:00+00:00</updated>
<id>https://gna.org/blog/atom.xml</id>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</title>
<published>2022-10-24T00:00:00+00:00</published>
<updated>2022-10-24T00:00:00+00:00</updated>
<link href="https://gna.org/blog/1-17-2-migration-security/" type="text/html"/>
<id>https://gna.org/blog/1-17-2-migration-security/</id>
<content type="html">&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna&#x2F;108953815492944898&quot;&gt;Gitea 1.17.2&lt;&#x2F;a&gt; includes a &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;commit&#x2F;e6b3be460840f1f982d5358198466e7d6f509d21&quot;&gt;security patch&lt;&#x2F;a&gt; that prevents bypassing URL restrictions during the migration of a remote repository.&lt;&#x2F;p&gt;
&lt;p&gt;When using the web interface or the REST API to &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;upstream&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L209-212&quot;&gt;import &#x2F; migrate a repository&lt;&#x2F;a&gt; that exists on another forge, the URL of the remote forge is &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L109&quot;&gt;verified&lt;&#x2F;a&gt; and rejected if not allowed. For instance if it starts with &lt;strong&gt;file:&#x2F;&#x2F;&lt;&#x2F;strong&gt;, contains &lt;strong&gt;%0c&lt;&#x2F;strong&gt; &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L43&quot;&gt;and more&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;p&gt;The migration then starts by &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L185&quot;&gt;asking for more information&lt;&#x2F;a&gt; about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.&lt;&#x2F;p&gt;
&lt;p&gt;For instance, when migrating a project from another Gitea instance, the Gitea migration driver &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;gitea_downloader.go#L153&quot;&gt;calls the GetRepo&lt;&#x2F;a&gt; function of the Gitea SDK, which returns the result of the &lt;a href=&quot;https:&#x2F;&#x2F;try.gitea.io&#x2F;api&#x2F;swagger#&#x2F;repository&#x2F;repoGet&quot;&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;a&gt; endpoint verbatim.&lt;&#x2F;p&gt;
&lt;p&gt;If a malicious server is setup by an adversary so that the &lt;strong&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;strong&gt; enpoint returns a URL designed to leak information from the server such as &lt;strong&gt;file:&#x2F;&#x2F;&#x2F;etc&#x2F;group&lt;&#x2F;strong&gt;, it should also be verified and discarded. This is the purpose of the &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L201-220&quot;&gt;check that was added&lt;&#x2F;a&gt; in Gitea 1.17.2.&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;go&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-go &quot;&gt;&lt;code class=&quot;language-go&quot; data-lang=&quot;go&quot;&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;downloader&lt;&#x2F;span&gt;&lt;span&gt;.(*&lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;RepositoryRestorer&lt;&#x2F;span&gt;&lt;span&gt;); !&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now the clone URL can be rewritten by the downloader so we must recheck
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;IsMigrateURLAllowed&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;doer&lt;&#x2F;span&gt;&lt;span&gt;); &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;!= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#d08770;&quot;&gt;nil &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: Ensure that we haven&amp;#39;t been redirected from an external to a local filesystem
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now we know all of these must parse
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;opts&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneAddr&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; || &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; &amp;amp;&amp;amp; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;fmt&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Errorf&lt;&#x2F;span&gt;&lt;span&gt;(&amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;repo info has changed from external to local filesystem&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot;)
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; We don&amp;#39;t actually need to check the OriginalURL as it isn&amp;#39;t used anywhere
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
</content>
</entry>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.3 git option injection explained</title>
<published>2022-10-17T00:00:00+00:00</published>

39
blog/index.html
View File

@ -213,6 +213,45 @@
<ul class="blog__list">
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-2-migration-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h2>
<p class="blog__post-meta">
<a href="https:&#x2F;&#x2F;dachary.org" class="post__author">Loïc Dachary</a>
&middot; 24
October
,
2022 &middot; <b>2 min read</b>
</p>
<p class="blog__post-description">Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API. </p>
</a>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</li>
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-3-git-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.3 git option injection explained</h2>

2
search_index.en.js
View File

File diff suppressed because one or more lines are too long

4
sitemap.xml
View File

@ -9,6 +9,10 @@
<url>
<loc>https://gna.org/blog/</loc>
</url>
<url>
<loc>https://gna.org/blog/1-17-2-migration-security/</loc>
<lastmod>2022-10-24</lastmod>
</url>
<url>
<loc>https://gna.org/blog/1-17-3-git-security/</loc>
<lastmod>2022-10-17</lastmod>

36
tags/gitea/atom.xml
View File

@ -4,8 +4,42 @@
<link href="https://gna.org/tags/gitea/atom.xml" rel="self" type="application/atom+xml"/>
<link href="https://gna.org"/>
<generator uri="https://www.getzola.org/">Zola</generator>
<updated>2022-10-17T00:00:00+00:00</updated>
<updated>2022-10-24T00:00:00+00:00</updated>
<id>https://gna.org/tags/gitea/atom.xml</id>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</title>
<published>2022-10-24T00:00:00+00:00</published>
<updated>2022-10-24T00:00:00+00:00</updated>
<link href="https://gna.org/blog/1-17-2-migration-security/" type="text/html"/>
<id>https://gna.org/blog/1-17-2-migration-security/</id>
<content type="html">&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna&#x2F;108953815492944898&quot;&gt;Gitea 1.17.2&lt;&#x2F;a&gt; includes a &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;commit&#x2F;e6b3be460840f1f982d5358198466e7d6f509d21&quot;&gt;security patch&lt;&#x2F;a&gt; that prevents bypassing URL restrictions during the migration of a remote repository.&lt;&#x2F;p&gt;
&lt;p&gt;When using the web interface or the REST API to &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;upstream&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L209-212&quot;&gt;import &#x2F; migrate a repository&lt;&#x2F;a&gt; that exists on another forge, the URL of the remote forge is &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L109&quot;&gt;verified&lt;&#x2F;a&gt; and rejected if not allowed. For instance if it starts with &lt;strong&gt;file:&#x2F;&#x2F;&lt;&#x2F;strong&gt;, contains &lt;strong&gt;%0c&lt;&#x2F;strong&gt; &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L43&quot;&gt;and more&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;p&gt;The migration then starts by &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L185&quot;&gt;asking for more information&lt;&#x2F;a&gt; about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.&lt;&#x2F;p&gt;
&lt;p&gt;For instance, when migrating a project from another Gitea instance, the Gitea migration driver &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;gitea_downloader.go#L153&quot;&gt;calls the GetRepo&lt;&#x2F;a&gt; function of the Gitea SDK, which returns the result of the &lt;a href=&quot;https:&#x2F;&#x2F;try.gitea.io&#x2F;api&#x2F;swagger#&#x2F;repository&#x2F;repoGet&quot;&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;a&gt; endpoint verbatim.&lt;&#x2F;p&gt;
&lt;p&gt;If a malicious server is setup by an adversary so that the &lt;strong&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;strong&gt; enpoint returns a URL designed to leak information from the server such as &lt;strong&gt;file:&#x2F;&#x2F;&#x2F;etc&#x2F;group&lt;&#x2F;strong&gt;, it should also be verified and discarded. This is the purpose of the &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L201-220&quot;&gt;check that was added&lt;&#x2F;a&gt; in Gitea 1.17.2.&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;go&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-go &quot;&gt;&lt;code class=&quot;language-go&quot; data-lang=&quot;go&quot;&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;downloader&lt;&#x2F;span&gt;&lt;span&gt;.(*&lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;RepositoryRestorer&lt;&#x2F;span&gt;&lt;span&gt;); !&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now the clone URL can be rewritten by the downloader so we must recheck
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;IsMigrateURLAllowed&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;doer&lt;&#x2F;span&gt;&lt;span&gt;); &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;!= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#d08770;&quot;&gt;nil &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: Ensure that we haven&amp;#39;t been redirected from an external to a local filesystem
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now we know all of these must parse
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;opts&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneAddr&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; || &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; &amp;amp;&amp;amp; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;fmt&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Errorf&lt;&#x2F;span&gt;&lt;span&gt;(&amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;repo info has changed from external to local filesystem&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot;)
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; We don&amp;#39;t actually need to check the OriginalURL as it isn&amp;#39;t used anywhere
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
</content>
</entry>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.3 git option injection explained</title>
<published>2022-10-17T00:00:00+00:00</published>

30
tags/gitea/index.html
View File

@ -219,6 +219,36 @@
</a></div>
<ul class="blog__list">
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-2-migration-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h2>
<p class="blog__post-meta">
24
October
,
2022 &middot; <b>2 min read</b>
</p>
<p class="blog__post-description">Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API. </p>
</a>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</li>
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-3-git-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.3 git option injection explained</h2>

36
tags/gna/atom.xml
View File

@ -4,8 +4,42 @@
<link href="https://gna.org/tags/gna/atom.xml" rel="self" type="application/atom+xml"/>
<link href="https://gna.org"/>
<generator uri="https://www.getzola.org/">Zola</generator>
<updated>2022-10-17T00:00:00+00:00</updated>
<updated>2022-10-24T00:00:00+00:00</updated>
<id>https://gna.org/tags/gna/atom.xml</id>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</title>
<published>2022-10-24T00:00:00+00:00</published>
<updated>2022-10-24T00:00:00+00:00</updated>
<link href="https://gna.org/blog/1-17-2-migration-security/" type="text/html"/>
<id>https://gna.org/blog/1-17-2-migration-security/</id>
<content type="html">&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna&#x2F;108953815492944898&quot;&gt;Gitea 1.17.2&lt;&#x2F;a&gt; includes a &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;commit&#x2F;e6b3be460840f1f982d5358198466e7d6f509d21&quot;&gt;security patch&lt;&#x2F;a&gt; that prevents bypassing URL restrictions during the migration of a remote repository.&lt;&#x2F;p&gt;
&lt;p&gt;When using the web interface or the REST API to &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;upstream&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L209-212&quot;&gt;import &#x2F; migrate a repository&lt;&#x2F;a&gt; that exists on another forge, the URL of the remote forge is &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L109&quot;&gt;verified&lt;&#x2F;a&gt; and rejected if not allowed. For instance if it starts with &lt;strong&gt;file:&#x2F;&#x2F;&lt;&#x2F;strong&gt;, contains &lt;strong&gt;%0c&lt;&#x2F;strong&gt; &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L43&quot;&gt;and more&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;p&gt;The migration then starts by &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L185&quot;&gt;asking for more information&lt;&#x2F;a&gt; about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.&lt;&#x2F;p&gt;
&lt;p&gt;For instance, when migrating a project from another Gitea instance, the Gitea migration driver &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;gitea_downloader.go#L153&quot;&gt;calls the GetRepo&lt;&#x2F;a&gt; function of the Gitea SDK, which returns the result of the &lt;a href=&quot;https:&#x2F;&#x2F;try.gitea.io&#x2F;api&#x2F;swagger#&#x2F;repository&#x2F;repoGet&quot;&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;a&gt; endpoint verbatim.&lt;&#x2F;p&gt;
&lt;p&gt;If a malicious server is setup by an adversary so that the &lt;strong&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;strong&gt; enpoint returns a URL designed to leak information from the server such as &lt;strong&gt;file:&#x2F;&#x2F;&#x2F;etc&#x2F;group&lt;&#x2F;strong&gt;, it should also be verified and discarded. This is the purpose of the &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L201-220&quot;&gt;check that was added&lt;&#x2F;a&gt; in Gitea 1.17.2.&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;go&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-go &quot;&gt;&lt;code class=&quot;language-go&quot; data-lang=&quot;go&quot;&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;downloader&lt;&#x2F;span&gt;&lt;span&gt;.(*&lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;RepositoryRestorer&lt;&#x2F;span&gt;&lt;span&gt;); !&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now the clone URL can be rewritten by the downloader so we must recheck
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;IsMigrateURLAllowed&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;doer&lt;&#x2F;span&gt;&lt;span&gt;); &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;!= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#d08770;&quot;&gt;nil &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: Ensure that we haven&amp;#39;t been redirected from an external to a local filesystem
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now we know all of these must parse
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;opts&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneAddr&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; || &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; &amp;amp;&amp;amp; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;fmt&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Errorf&lt;&#x2F;span&gt;&lt;span&gt;(&amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;repo info has changed from external to local filesystem&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot;)
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; We don&amp;#39;t actually need to check the OriginalURL as it isn&amp;#39;t used anywhere
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
</content>
</entry>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.3 git option injection explained</title>
<published>2022-10-17T00:00:00+00:00</published>

30
tags/gna/index.html
View File

@ -219,6 +219,36 @@
</a></div>
<ul class="blog__list">
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-2-migration-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h2>
<p class="blog__post-meta">
24
October
,
2022 &middot; <b>2 min read</b>
</p>
<p class="blog__post-description">Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API. </p>
</a>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</li>
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-3-git-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.3 git option injection explained</h2>

16
tags/index.html
View File

@ -297,7 +297,7 @@
<span class="tag__meta">11 entries</span>
<span class="tag__meta">12 entries</span>
</a>
<a class="tag__rss-link" href="https:&#x2F;&#x2F;gna.org&#x2F;tags&#x2F;gitea&#x2F;atom.xml" target="_blank" rel="noopener" title="RSS">
<img
@ -315,7 +315,7 @@
<span class="tag__meta">11 entries</span>
<span class="tag__meta">12 entries</span>
</a>
<a class="tag__rss-link" href="https:&#x2F;&#x2F;gna.org&#x2F;tags&#x2F;gna&#x2F;atom.xml" target="_blank" rel="noopener" title="RSS">
<img
@ -353,7 +353,7 @@
<span class="tag__meta">9 entries</span>
<span class="tag__meta">10 entries</span>
</a>
<a class="tag__rss-link" href="https:&#x2F;&#x2F;gna.org&#x2F;tags&#x2F;problem&#x2F;atom.xml" target="_blank" rel="noopener" title="RSS">
<img
@ -371,9 +371,7 @@
<span class="tag__meta">1 entry</span>
<span class="tag__meta">2 entries</span>
</a>
<a class="tag__rss-link" href="https:&#x2F;&#x2F;gna.org&#x2F;tags&#x2F;security&#x2F;atom.xml" target="_blank" rel="noopener" title="RSS">
<img
@ -391,9 +389,7 @@
<span class="tag__meta">1 entry</span>
<span class="tag__meta">2 entries</span>
</a>
<a class="tag__rss-link" href="https:&#x2F;&#x2F;gna.org&#x2F;tags&#x2F;solution&#x2F;atom.xml" target="_blank" rel="noopener" title="RSS">
<img
@ -447,7 +443,7 @@
<span class="tag__meta">4 entries</span>
<span class="tag__meta">5 entries</span>
</a>
<a class="tag__rss-link" href="https:&#x2F;&#x2F;gna.org&#x2F;tags&#x2F;upgrade&#x2F;atom.xml" target="_blank" rel="noopener" title="RSS">
<img

36
tags/problem/atom.xml
View File

@ -4,8 +4,42 @@
<link href="https://gna.org/tags/problem/atom.xml" rel="self" type="application/atom+xml"/>
<link href="https://gna.org"/>
<generator uri="https://www.getzola.org/">Zola</generator>
<updated>2022-10-17T00:00:00+00:00</updated>
<updated>2022-10-24T00:00:00+00:00</updated>
<id>https://gna.org/tags/problem/atom.xml</id>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</title>
<published>2022-10-24T00:00:00+00:00</published>
<updated>2022-10-24T00:00:00+00:00</updated>
<link href="https://gna.org/blog/1-17-2-migration-security/" type="text/html"/>
<id>https://gna.org/blog/1-17-2-migration-security/</id>
<content type="html">&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna&#x2F;108953815492944898&quot;&gt;Gitea 1.17.2&lt;&#x2F;a&gt; includes a &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;commit&#x2F;e6b3be460840f1f982d5358198466e7d6f509d21&quot;&gt;security patch&lt;&#x2F;a&gt; that prevents bypassing URL restrictions during the migration of a remote repository.&lt;&#x2F;p&gt;
&lt;p&gt;When using the web interface or the REST API to &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;upstream&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L209-212&quot;&gt;import &#x2F; migrate a repository&lt;&#x2F;a&gt; that exists on another forge, the URL of the remote forge is &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L109&quot;&gt;verified&lt;&#x2F;a&gt; and rejected if not allowed. For instance if it starts with &lt;strong&gt;file:&#x2F;&#x2F;&lt;&#x2F;strong&gt;, contains &lt;strong&gt;%0c&lt;&#x2F;strong&gt; &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L43&quot;&gt;and more&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;p&gt;The migration then starts by &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L185&quot;&gt;asking for more information&lt;&#x2F;a&gt; about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.&lt;&#x2F;p&gt;
&lt;p&gt;For instance, when migrating a project from another Gitea instance, the Gitea migration driver &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;gitea_downloader.go#L153&quot;&gt;calls the GetRepo&lt;&#x2F;a&gt; function of the Gitea SDK, which returns the result of the &lt;a href=&quot;https:&#x2F;&#x2F;try.gitea.io&#x2F;api&#x2F;swagger#&#x2F;repository&#x2F;repoGet&quot;&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;a&gt; endpoint verbatim.&lt;&#x2F;p&gt;
&lt;p&gt;If a malicious server is setup by an adversary so that the &lt;strong&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;strong&gt; enpoint returns a URL designed to leak information from the server such as &lt;strong&gt;file:&#x2F;&#x2F;&#x2F;etc&#x2F;group&lt;&#x2F;strong&gt;, it should also be verified and discarded. This is the purpose of the &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L201-220&quot;&gt;check that was added&lt;&#x2F;a&gt; in Gitea 1.17.2.&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;go&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-go &quot;&gt;&lt;code class=&quot;language-go&quot; data-lang=&quot;go&quot;&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;downloader&lt;&#x2F;span&gt;&lt;span&gt;.(*&lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;RepositoryRestorer&lt;&#x2F;span&gt;&lt;span&gt;); !&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now the clone URL can be rewritten by the downloader so we must recheck
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;IsMigrateURLAllowed&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;doer&lt;&#x2F;span&gt;&lt;span&gt;); &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;!= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#d08770;&quot;&gt;nil &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: Ensure that we haven&amp;#39;t been redirected from an external to a local filesystem
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now we know all of these must parse
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;opts&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneAddr&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; || &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; &amp;amp;&amp;amp; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;fmt&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Errorf&lt;&#x2F;span&gt;&lt;span&gt;(&amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;repo info has changed from external to local filesystem&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot;)
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; We don&amp;#39;t actually need to check the OriginalURL as it isn&amp;#39;t used anywhere
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
</content>
</entry>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.3 git option injection explained</title>
<published>2022-10-17T00:00:00+00:00</published>

30
tags/problem/index.html
View File

@ -219,6 +219,36 @@
</a></div>
<ul class="blog__list">
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-2-migration-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h2>
<p class="blog__post-meta">
24
October
,
2022 &middot; <b>2 min read</b>
</p>
<p class="blog__post-description">Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API. </p>
</a>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</li>
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-3-git-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.3 git option injection explained</h2>

36
tags/security/atom.xml
View File

@ -4,8 +4,42 @@
<link href="https://gna.org/tags/security/atom.xml" rel="self" type="application/atom+xml"/>
<link href="https://gna.org"/>
<generator uri="https://www.getzola.org/">Zola</generator>
<updated>2022-10-17T00:00:00+00:00</updated>
<updated>2022-10-24T00:00:00+00:00</updated>
<id>https://gna.org/tags/security/atom.xml</id>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</title>
<published>2022-10-24T00:00:00+00:00</published>
<updated>2022-10-24T00:00:00+00:00</updated>
<link href="https://gna.org/blog/1-17-2-migration-security/" type="text/html"/>
<id>https://gna.org/blog/1-17-2-migration-security/</id>
<content type="html">&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna&#x2F;108953815492944898&quot;&gt;Gitea 1.17.2&lt;&#x2F;a&gt; includes a &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;commit&#x2F;e6b3be460840f1f982d5358198466e7d6f509d21&quot;&gt;security patch&lt;&#x2F;a&gt; that prevents bypassing URL restrictions during the migration of a remote repository.&lt;&#x2F;p&gt;
&lt;p&gt;When using the web interface or the REST API to &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;upstream&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L209-212&quot;&gt;import &#x2F; migrate a repository&lt;&#x2F;a&gt; that exists on another forge, the URL of the remote forge is &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L109&quot;&gt;verified&lt;&#x2F;a&gt; and rejected if not allowed. For instance if it starts with &lt;strong&gt;file:&#x2F;&#x2F;&lt;&#x2F;strong&gt;, contains &lt;strong&gt;%0c&lt;&#x2F;strong&gt; &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L43&quot;&gt;and more&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;p&gt;The migration then starts by &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L185&quot;&gt;asking for more information&lt;&#x2F;a&gt; about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.&lt;&#x2F;p&gt;
&lt;p&gt;For instance, when migrating a project from another Gitea instance, the Gitea migration driver &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;gitea_downloader.go#L153&quot;&gt;calls the GetRepo&lt;&#x2F;a&gt; function of the Gitea SDK, which returns the result of the &lt;a href=&quot;https:&#x2F;&#x2F;try.gitea.io&#x2F;api&#x2F;swagger#&#x2F;repository&#x2F;repoGet&quot;&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;a&gt; endpoint verbatim.&lt;&#x2F;p&gt;
&lt;p&gt;If a malicious server is setup by an adversary so that the &lt;strong&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;strong&gt; enpoint returns a URL designed to leak information from the server such as &lt;strong&gt;file:&#x2F;&#x2F;&#x2F;etc&#x2F;group&lt;&#x2F;strong&gt;, it should also be verified and discarded. This is the purpose of the &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L201-220&quot;&gt;check that was added&lt;&#x2F;a&gt; in Gitea 1.17.2.&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;go&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-go &quot;&gt;&lt;code class=&quot;language-go&quot; data-lang=&quot;go&quot;&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;downloader&lt;&#x2F;span&gt;&lt;span&gt;.(*&lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;RepositoryRestorer&lt;&#x2F;span&gt;&lt;span&gt;); !&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now the clone URL can be rewritten by the downloader so we must recheck
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;IsMigrateURLAllowed&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;doer&lt;&#x2F;span&gt;&lt;span&gt;); &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;!= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#d08770;&quot;&gt;nil &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: Ensure that we haven&amp;#39;t been redirected from an external to a local filesystem
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now we know all of these must parse
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;opts&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneAddr&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; || &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; &amp;amp;&amp;amp; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;fmt&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Errorf&lt;&#x2F;span&gt;&lt;span&gt;(&amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;repo info has changed from external to local filesystem&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot;)
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; We don&amp;#39;t actually need to check the OriginalURL as it isn&amp;#39;t used anywhere
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
</content>
</entry>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.3 git option injection explained</title>
<published>2022-10-17T00:00:00+00:00</published>

30
tags/security/index.html
View File

@ -219,6 +219,36 @@
</a></div>
<ul class="blog__list">
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-2-migration-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h2>
<p class="blog__post-meta">
24
October
,
2022 &middot; <b>2 min read</b>
</p>
<p class="blog__post-description">Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API. </p>
</a>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</li>
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-3-git-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.3 git option injection explained</h2>

36
tags/solution/atom.xml
View File

@ -4,8 +4,42 @@
<link href="https://gna.org/tags/solution/atom.xml" rel="self" type="application/atom+xml"/>
<link href="https://gna.org"/>
<generator uri="https://www.getzola.org/">Zola</generator>
<updated>2022-10-17T00:00:00+00:00</updated>
<updated>2022-10-24T00:00:00+00:00</updated>
<id>https://gna.org/tags/solution/atom.xml</id>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</title>
<published>2022-10-24T00:00:00+00:00</published>
<updated>2022-10-24T00:00:00+00:00</updated>
<link href="https://gna.org/blog/1-17-2-migration-security/" type="text/html"/>
<id>https://gna.org/blog/1-17-2-migration-security/</id>
<content type="html">&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna&#x2F;108953815492944898&quot;&gt;Gitea 1.17.2&lt;&#x2F;a&gt; includes a &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;commit&#x2F;e6b3be460840f1f982d5358198466e7d6f509d21&quot;&gt;security patch&lt;&#x2F;a&gt; that prevents bypassing URL restrictions during the migration of a remote repository.&lt;&#x2F;p&gt;
&lt;p&gt;When using the web interface or the REST API to &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;upstream&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L209-212&quot;&gt;import &#x2F; migrate a repository&lt;&#x2F;a&gt; that exists on another forge, the URL of the remote forge is &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L109&quot;&gt;verified&lt;&#x2F;a&gt; and rejected if not allowed. For instance if it starts with &lt;strong&gt;file:&#x2F;&#x2F;&lt;&#x2F;strong&gt;, contains &lt;strong&gt;%0c&lt;&#x2F;strong&gt; &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L43&quot;&gt;and more&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;p&gt;The migration then starts by &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L185&quot;&gt;asking for more information&lt;&#x2F;a&gt; about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.&lt;&#x2F;p&gt;
&lt;p&gt;For instance, when migrating a project from another Gitea instance, the Gitea migration driver &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;gitea_downloader.go#L153&quot;&gt;calls the GetRepo&lt;&#x2F;a&gt; function of the Gitea SDK, which returns the result of the &lt;a href=&quot;https:&#x2F;&#x2F;try.gitea.io&#x2F;api&#x2F;swagger#&#x2F;repository&#x2F;repoGet&quot;&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;a&gt; endpoint verbatim.&lt;&#x2F;p&gt;
&lt;p&gt;If a malicious server is setup by an adversary so that the &lt;strong&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;strong&gt; enpoint returns a URL designed to leak information from the server such as &lt;strong&gt;file:&#x2F;&#x2F;&#x2F;etc&#x2F;group&lt;&#x2F;strong&gt;, it should also be verified and discarded. This is the purpose of the &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L201-220&quot;&gt;check that was added&lt;&#x2F;a&gt; in Gitea 1.17.2.&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;go&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-go &quot;&gt;&lt;code class=&quot;language-go&quot; data-lang=&quot;go&quot;&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;downloader&lt;&#x2F;span&gt;&lt;span&gt;.(*&lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;RepositoryRestorer&lt;&#x2F;span&gt;&lt;span&gt;); !&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now the clone URL can be rewritten by the downloader so we must recheck
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;IsMigrateURLAllowed&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;doer&lt;&#x2F;span&gt;&lt;span&gt;); &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;!= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#d08770;&quot;&gt;nil &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: Ensure that we haven&amp;#39;t been redirected from an external to a local filesystem
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now we know all of these must parse
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;opts&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneAddr&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; || &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; &amp;amp;&amp;amp; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;fmt&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Errorf&lt;&#x2F;span&gt;&lt;span&gt;(&amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;repo info has changed from external to local filesystem&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot;)
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; We don&amp;#39;t actually need to check the OriginalURL as it isn&amp;#39;t used anywhere
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
</content>
</entry>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.3 git option injection explained</title>
<published>2022-10-17T00:00:00+00:00</published>

30
tags/solution/index.html
View File

@ -219,6 +219,36 @@
</a></div>
<ul class="blog__list">
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-2-migration-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h2>
<p class="blog__post-meta">
24
October
,
2022 &middot; <b>2 min read</b>
</p>
<p class="blog__post-description">Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API. </p>
</a>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</li>
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-3-git-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.3 git option injection explained</h2>

36
tags/upgrade/atom.xml
View File

@ -4,8 +4,42 @@
<link href="https://gna.org/tags/upgrade/atom.xml" rel="self" type="application/atom+xml"/>
<link href="https://gna.org"/>
<generator uri="https://www.getzola.org/">Zola</generator>
<updated>2022-10-17T00:00:00+00:00</updated>
<updated>2022-10-24T00:00:00+00:00</updated>
<id>https://gna.org/tags/upgrade/atom.xml</id>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</title>
<published>2022-10-24T00:00:00+00:00</published>
<updated>2022-10-24T00:00:00+00:00</updated>
<link href="https://gna.org/blog/1-17-2-migration-security/" type="text/html"/>
<id>https://gna.org/blog/1-17-2-migration-security/</id>
<content type="html">&lt;p&gt;&lt;a href=&quot;https:&#x2F;&#x2F;pouet.chapril.org&#x2F;@gna&#x2F;108953815492944898&quot;&gt;Gitea 1.17.2&lt;&#x2F;a&gt; includes a &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;commit&#x2F;e6b3be460840f1f982d5358198466e7d6f509d21&quot;&gt;security patch&lt;&#x2F;a&gt; that prevents bypassing URL restrictions during the migration of a remote repository.&lt;&#x2F;p&gt;
&lt;p&gt;When using the web interface or the REST API to &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;upstream&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L209-212&quot;&gt;import &#x2F; migrate a repository&lt;&#x2F;a&gt; that exists on another forge, the URL of the remote forge is &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;routers&#x2F;api&#x2F;v1&#x2F;repo&#x2F;migrate.go#L109&quot;&gt;verified&lt;&#x2F;a&gt; and rejected if not allowed. For instance if it starts with &lt;strong&gt;file:&#x2F;&#x2F;&lt;&#x2F;strong&gt;, contains &lt;strong&gt;%0c&lt;&#x2F;strong&gt; &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L43&quot;&gt;and more&lt;&#x2F;a&gt;.&lt;&#x2F;p&gt;
&lt;p&gt;The migration then starts by &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L185&quot;&gt;asking for more information&lt;&#x2F;a&gt; about the software project to be migrated, using this verified URL. The structure that is returned is supposed to contain an exact copy of the URL from which the migration must be done. But there is no guarantee that it does and some of the drivers implemented in Gitea may return a different URL.&lt;&#x2F;p&gt;
&lt;p&gt;For instance, when migrating a project from another Gitea instance, the Gitea migration driver &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;gitea_downloader.go#L153&quot;&gt;calls the GetRepo&lt;&#x2F;a&gt; function of the Gitea SDK, which returns the result of the &lt;a href=&quot;https:&#x2F;&#x2F;try.gitea.io&#x2F;api&#x2F;swagger#&#x2F;repository&#x2F;repoGet&quot;&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;a&gt; endpoint verbatim.&lt;&#x2F;p&gt;
&lt;p&gt;If a malicious server is setup by an adversary so that the &lt;strong&gt;&#x2F;repos&#x2F;{owner}&#x2F;{repo}&lt;&#x2F;strong&gt; enpoint returns a URL designed to leak information from the server such as &lt;strong&gt;file:&#x2F;&#x2F;&#x2F;etc&#x2F;group&lt;&#x2F;strong&gt;, it should also be verified and discarded. This is the purpose of the &lt;a href=&quot;https:&#x2F;&#x2F;lab.forgefriends.org&#x2F;forgefriends&#x2F;forgefriends&#x2F;-&#x2F;blob&#x2F;9fb251fb6fa2bb857bb8f5ae27f06c9d597bc1eb&#x2F;services&#x2F;migrations&#x2F;migrate.go#L201-220&quot;&gt;check that was added&lt;&#x2F;a&gt; in Gitea 1.17.2.&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;go&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-go &quot;&gt;&lt;code class=&quot;language-go&quot; data-lang=&quot;go&quot;&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: If the downloader is not a RepositoryRestorer then we need to recheck the CloneURL
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;downloader&lt;&#x2F;span&gt;&lt;span&gt;.(*&lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;RepositoryRestorer&lt;&#x2F;span&gt;&lt;span&gt;); !&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;ok &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now the clone URL can be rewritten by the downloader so we must recheck
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;IsMigrateURLAllowed&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;doer&lt;&#x2F;span&gt;&lt;span&gt;); &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err &lt;&#x2F;span&gt;&lt;span&gt;!= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#d08770;&quot;&gt;nil &lt;&#x2F;span&gt;&lt;span&gt;{
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;err
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; SECURITY: Ensure that we haven&amp;#39;t been redirected from an external to a local filesystem
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; Now we know all of these must parse
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;opts&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneAddr&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;, &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;_ &lt;&#x2F;span&gt;&lt;span&gt;:= &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;url&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Parse&lt;&#x2F;span&gt;&lt;span&gt;(&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;repo&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;CloneURL&lt;&#x2F;span&gt;&lt;span&gt;)
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; || &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;== &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;if &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;file&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot; &amp;amp;&amp;amp; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;cloneAddrURL&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Scheme &lt;&#x2F;span&gt;&lt;span&gt;!= &amp;quot;&amp;quot; {
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#b48ead;&quot;&gt;return &lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;fmt&lt;&#x2F;span&gt;&lt;span&gt;.&lt;&#x2F;span&gt;&lt;span style=&quot;color:#bf616a;&quot;&gt;Errorf&lt;&#x2F;span&gt;&lt;span&gt;(&amp;quot;&lt;&#x2F;span&gt;&lt;span style=&quot;color:#a3be8c;&quot;&gt;repo info has changed from external to local filesystem&lt;&#x2F;span&gt;&lt;span&gt;&amp;quot;)
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;span&gt;
&lt;&#x2F;span&gt;&lt;span&gt; &lt;&#x2F;span&gt;&lt;span style=&quot;color:#65737e;&quot;&gt;&#x2F;&#x2F; We don&amp;#39;t actually need to check the OriginalURL as it isn&amp;#39;t used anywhere
&lt;&#x2F;span&gt;&lt;span&gt; }
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
</content>
</entry>
<entry xml:lang="en">
<title>[security] Gitea &lt; 1.17.3 git option injection explained</title>
<published>2022-10-17T00:00:00+00:00</published>

30
tags/upgrade/index.html
View File

@ -219,6 +219,36 @@
</a></div>
<ul class="blog__list">
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-2-migration-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.2 bypassing URL restrictions during migration explained</h2>
<p class="blog__post-meta">
24
October
,
2022 &middot; <b>2 min read</b>
</p>
<p class="blog__post-description">Prior to Gitea 1.17.2 a malicious Gitea server could be used to request local files using the migration web interface or the REST API. </p>
</a>
<div class="blog__post-tag-container">
<a class="blog__post-tag" href="/tags/gna">#gna</a>
<a class="blog__post-tag" href="/tags/gitea">#gitea</a>
<a class="blog__post-tag" href="/tags/security">#security</a>
<a class="blog__post-tag" href="/tags/problem">#problem</a>
<a class="blog__post-tag" href="/tags/upgrade">#upgrade</a>
<a class="blog__post-tag" href="/tags/solution">#solution</a>
</div>
</li>
<li class="blog__post-item">
<a href="https://gna.org/blog/1-17-3-git-security/" class="blog__post-link">
<h2 class="blog__post-title">[security] Gitea &lt; 1.17.3 git option injection explained</h2>