Arbitrary Code Execution in Gitea
The git hook feature in Gitea 1.1.0 through 1.12.5 allows for authenticated remote code execution.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-14144US | high7.2 | Exploit | ||
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., on… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.htmlWEB
- https://docs.github.com/en/enterprise-server%402.19/admin/policies/creating-a-pre-receive-hook-scriptWEB
- https://docs.github.com/en/enterprise-server@2.19/admin/policies/creating-a-pre-receive-hook-scriptWEB
- https://docs.gitlab.com/ee/administration/server_hooks.htmlWEB
- https://github.com/PandatiX/CVE-2021-28378WEB
- https://github.com/PandatiX/CVE-2021-28378#notesWEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/8fe8ab5cbf2977f3a01ea12361df2cd76dce3ea9WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan