Skip to content
Threat Feed
Subscribe
critical threat exploited

Gitea Actions Artifacts V4 HMAC Ambiguity Allows Cross-Repository Data Access

A vulnerability in Gitea Actions Artifacts V4 allows authenticated attackers, with permission to run an Actions job, to bypass intended access controls by manipulating signed artifact URLs, enabling unauthorized reading of artifacts from other repositories or writing arbitrary data to other tasks' artifact staging areas, potentially leading to data exfiltration or integrity compromise.

A critical vulnerability (GHSA-hg5r-vq93-9fv6) has been identified in Gitea Actions Artifacts V4 that allows an authenticated attacker to bypass access controls using specially crafted signed URLs. This flaw, present in Gitea versions from v1.22.6 through v1.26.1, arises because the HMAC signature for artifact URLs is generated by concatenating fields (such as artifactName, taskID, and artifactID) without proper delimiters or length-prefixing. An attacker with permissions to execute a Gitea Actions job can forge a signed URL to achieve two primary objectives: unauthorized cross-repository artifact reading (DownloadArtifact path) or unauthorized cross-task artifact staging write and metadata mutation (UploadArtifact path). The vulnerability permits access to private repository data or the injection of arbitrary data into other running tasks' artifact contexts, posing a significant risk to data confidentiality and integrity within affected Gitea instances.

Attack Chain

  1. An attacker gains legitimate execution permissions within Gitea Actions to run a job.
  2. The attacker creates their own Gitea Actions task, publishes an artifact, and obtains a legitimate signed URL for this attacker-controlled artifact.
  3. The attacker crafts a new URL by manipulating the artifactName, taskID, and artifactID parameters within the signed URL, specifically choosing values (e.g., artifactName="artifact-795-1", taskID=53, artifactID=48<attacker artifact id>) that, when concatenated, produce the same HMAC input as the original legitimate URL.
  4. The attacker, acting as an unauthenticated client, sends the forged URL as an HTTP GET request to the Gitea /api/actions/artifactsv4/DownloadArtifact endpoint to attempt data exfiltration.
  5. Gitea's server-side verifySignature() function validates the HMAC of the forged URL as legitimate due to the underlying concatenation flaw.
  6. The server then proceeds to resolve the artifact using the attacker-controlled taskID and artifactName from the URL, which now points to a target task or artifact in a different repository.
  7. Gitea retrieves and serves the artifact from the targeted repository or task context to the attacker, leading to unauthorized cross-repository artifact data exposure. Alternatively, the attacker can send a forged PUT request to /api/actions/artifactsv4/UploadArtifact to write arbitrary data into another running task's artifact staging area and mutate its metadata.

Impact

Successful exploitation of this vulnerability can lead to severe consequences for organizations utilizing affected Gitea instances. Attackers can exfiltrate sensitive data from private repositories by reading artifacts belonging to other users or teams. Furthermore, the ability to write arbitrary data into another task's artifact staging area compromises data integrity, potentially allowing for injection of malicious code, corrupted build artifacts, or other integrity-damaging actions. While no active in-the-wild exploitation is reported, the vulnerability's impact is high (confidentiality and integrity), as demonstrated by the proof-of-concept allowing cross-repository private artifact disclosure and cross-context staging write with metadata mutation.

Recommendation

  • Upgrade Gitea instances to a patched version immediately to remediate GHSA-hg5r-vq93-9fv6.
  • Monitor Gitea access logs for unusual download or upload patterns involving the /api/actions/artifactsv4/DownloadArtifact and /api/actions/artifactsv4/UploadArtifact endpoints, especially for unauthenticated requests or requests with unusual taskID or artifactID patterns in the query string.
  • Implement strong authentication and authorization policies for Gitea Actions job execution to limit potential attackers' initial access.