Affected: Bitnami: gitea

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Affected: Go: gitea.dev

### Summary

Gitea's `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content.

An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.

### Details

`services/repository/files/patch.go` applies attacker-controlled patches in a shared bare temporary clone:

```go cmdApply := gitcmd.NewCommand("apply", "--index", "--recount", "--cached", "--binary") if git.DefaultFeatures().CheckVersionAtLeast("2.32") { cmdApply.AddArguments("-3") } ````

Submitting the same patch twice creates an add/add collision. Git's three-way fallback checks the indexed path out even though the operation is performed with `--cached`.

In a bare clone, the repository root is `$GIT_DIR`. As a result, an executable entry named:

```text hooks/post-index-change ```

becomes a live Git hook.

Git invokes the hook while writing the index, allowing repository-controlled content to execute arbitrary commands as the Gitea service account.

The hook's return value is not propagated to the `diffpatch` response.

The attached PoC stores command output in Git objects and creates a branch containing the result, so no outbound connection is required. The result is fetched through authenticated smart HTTP.

### PoC

The supplied `gitea_diffpatch_rce_poc.py` uses an…

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gitea ausnutzen, um beliebigen Programmcode auszuführen.