{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/gitea--1.26.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gitea \u003c= 1.26.2"],"_cs_severities":["high"],"_cs_tags":["ssrf","gitea","web-vulnerability","internal-reconnaissance"],"_cs_type":"advisory","_cs_vendors":["Gitea Ltd"],"content_html":"\u003cp\u003eTwo distinct Server-Side Request Forgery (SSRF) vulnerabilities have been identified in Gitea, affecting versions up to and including 1.26.2. The first finding concerns the \u003ccode\u003ehostmatcher\u003c/code\u003e IP classification logic used for outbound HTTP requests initiated by webhooks and repository migrations. This filter, intended to prevent internal network access, incorrectly allows connections to CGNAT (100.64.0.0/10) and several IPv6 transition prefixes, including NAT64, 6to4, and Teredo. An authenticated user can exploit this by crafting a webhook or migration URL to an internal CGNAT IP, causing Gitea to fetch the resource and store the response (up to 1MB) for retrieval. The second finding relates to the OpenID sign-in form, which, when enabled, allows unauthenticated users to provide a malicious OpenID provider URL. Gitea then fetches this URL server-side using \u003ccode\u003ehttp.DefaultClient\u003c/code\u003e without any IP filtering, enabling arbitrary GET requests against internal network resources. Both vulnerabilities can lead to significant internal network reconnaissance and potential data exfiltration from the Gitea host.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003ch3 id=\"scenario-1-authenticated-webhookmigration-ssrf\"\u003eScenario 1: Authenticated Webhook/Migration SSRF\u003c/h3\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes authenticated access to a Gitea instance, either as a regular user or a repository administrator.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the webhook creation interface or initiates a repository migration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious URL for the webhook or migration target, specifying an internal host within a CGNAT IP range (e.g., \u003ccode\u003ehttp://100.64.0.2:8080/internal\u003c/code\u003e) or an unblocked IPv6 transition prefix.\u003c/li\u003e\n\u003cli\u003eThe crafted URL is submitted via Gitea's API for webhook or migration configuration.\u003c/li\u003e\n\u003cli\u003eGitea's \u003ccode\u003ehostmatcher\u003c/code\u003e IP filter, due to a flaw in its \u003ccode\u003eIsGlobalUnicast() \u0026amp;\u0026amp; !IsPrivate()\u003c/code\u003e logic, fails to block the CGNAT or IPv6 transition range IP.\u003c/li\u003e\n\u003cli\u003eGitea initiates an outbound HTTP request to the specified internal CGNAT host.\u003c/li\u003e\n\u003cli\u003eThe target internal host's HTTP response, including status, headers, and body (up to 1 MB), is captured by Gitea.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves the stored response from the webhook delivery logs or migration details, gaining insights into internal network services or sensitive data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch3 id=\"scenario-2-unauthenticated-openid-ssrf\"\u003eScenario 2: Unauthenticated OpenID SSRF\u003c/h3\u003e\n\u003col\u003e\n\u003cli\u003eThe Gitea instance has OpenID sign-in enabled, which is the default setting prior to initial installation completion (\u003ccode\u003e!InstallLock\u003c/code\u003e) or explicitly configured afterwards.\u003c/li\u003e\n\u003cli\u003eAn unauthenticated attacker sends a specially crafted HTTP POST request to Gitea's \u003ccode\u003e/user/login/openid\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe POST request includes an \u003ccode\u003eopenid\u003c/code\u003e parameter with a URL pointing to an internal IP address (e.g., \u003ccode\u003ehttp://192.168.1.100/admin\u003c/code\u003e) within the Gitea's network.\u003c/li\u003e\n\u003cli\u003eGitea's \u003ccode\u003eopenid-go\u003c/code\u003e library, responsible for OpenID discovery, uses \u003ccode\u003ehttp.DefaultClient\u003c/code\u003e without any IP filtering or \u003ccode\u003ehostmatcher\u003c/code\u003e integration.\u003c/li\u003e\n\u003cli\u003eGitea initiates an outbound HTTP GET request to the internal IP address specified in the \u003ccode\u003eopenid\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe internal service receives the GET request from Gitea, potentially triggering actions, revealing its presence, or exposing information, even if the response is not directly returned to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these SSRF vulnerabilities can lead to significant internal network reconnaissance, allowing attackers to discover active hosts, open ports, and running services within the Gitea environment. For the webhook and migration SSRF, sensitive information (up to 1MB of HTTP response data) from internal services can be exfiltrated and viewed by the attacker, potentially revealing API keys, configuration details, or other confidential data. While the OpenID SSRF does not directly exfiltrate data to the attacker, it enables unauthenticated port scanning and interaction with internal services, which can be a precursor to more sophisticated attacks, including lateral movement or exploitation of other internal vulnerabilities. Organizations using Gitea versions 1.26.2 or older are at risk, particularly those with OpenID sign-in enabled or those that allow user-created webhooks and repository migrations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect attempts at exploiting the OpenID SSRF vulnerability via webserver logs.\u003c/li\u003e\n\u003cli\u003ePatch Gitea instances to the latest available version immediately, as fixes for these SSRF vulnerabilities are expected in subsequent releases.\u003c/li\u003e\n\u003cli\u003eRestrict outbound network access from Gitea servers to only necessary external endpoints using firewall rules to mitigate the impact of SSRF, even if internal IP filtering is bypassed.\u003c/li\u003e\n\u003cli\u003eIf OpenID sign-in is not strictly required, disable it in Gitea's configuration to eliminate the unauthenticated SSRF vector.\u003c/li\u003e\n\u003cli\u003eMonitor Gitea's outgoing network connections for attempts to contact internal IP addresses, especially those in CGNAT ranges (e.g., 100.64.0.0/10) or RFC 1918 ranges, which would indicate successful exploitation of the webhook/migration SSRF.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T21:17:37Z","date_published":"2026-07-21T21:17:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gitea-ssrf/","summary":"Two Server-Side Request Forgery (SSRF) vulnerabilities in Gitea version 1.26.2 and earlier allow authenticated users to bypass IP filtering for webhooks and repository migrations by targeting CGNAT and IPv6 transition prefixes, and unauthenticated users to trigger arbitrary GET requests against internal hosts via the OpenID sign-in form, potentially leading to internal network discovery and data exposure.","title":"Gitea Server-Side Request Forgery Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-07-gitea-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Gitea \u003c= 1.26.2","version":"https://jsonfeed.org/version/1.1"}