Skip to content

Commit b87a358

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2r5c-gw76-rh3w GHSA-rjvx-x5h2-6px5
1 parent 372d6b8 commit b87a358

2 files changed

Lines changed: 144 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/07/GHSA-2r5c-gw76-rh3w/GHSA-2r5c-gw76-rh3w.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2r5c-gw76-rh3w",
4+
"modified": "2026-07-21T20:27:17Z",
5+
"published": "2026-07-21T20:27:17Z",
6+
"aliases": [
7+
"CVE-2026-22874"
8+
],
9+
"summary": "Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter",
10+
"details": "## Summary\n\nGitea's default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go's standard library [`net.IP.IsPrivate()`](https://pkg.go.dev/net#IP.IsPrivate), which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal networks, and IPv6 transition mechanisms are not blocked, allowing authenticated users to send HTTP requests to those destinations and read the responses via the webhook history UI.\n\n## Details\n\nThe vulnerability lives in [`HostMatchList.checkIP`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L96-L114), specifically [line 103](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L103):\n\n```go\ncase MatchBuiltinExternal:\n if ip.IsGlobalUnicast() && !ip.IsPrivate() {\n return true\n }\n```\n\n`net.IP.IsPrivate()` recognises only:\n- `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (RFC 1918)\n- `fc00::/7` (RFC 4193 IPv6 ULA)\n\nIt does **not** recognise:\n\n| Range | Description |\n|---|---|\n| `100.64.0.0/10` | RFC 6598 Carrier-Grade NAT |\n| `168.63.129.16/32` | Azure WireServer metadata endpoint |\n| `172.32.0.0/11` | Non-RFC1918 portion of `172.0.0.0/8` (real-world internal use) |\n| `64:ff9b::/96` | RFC 6052 IPv6 NAT64 (can embed `169.254.169.254`) |\n| `2001::/32` | RFC 4380 Teredo tunneling |\n| `2002::/16` | RFC 3056 6to4 |\n| `2001:db8::/32` | RFC 3849 documentation |\n\nThe default is reached by webhook delivery at [`services/webhook/deliver.go#L312-L316`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/services/webhook/deliver.go#L312-L316) and by repository migrations at [`services/migrations/migrate.go#L522`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/services/migrations/migrate.go#L522).\n\nThe SSRF is **not blind**. Webhook delivery captures the response status, headers, and up to 1 MiB of body ([`services/webhook/deliver.go#L259-L270`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/services/webhook/deliver.go#L259-L270)) and renders them in the webhook history UI ([`templates/repo/settings/webhook/history.tmpl#L75-L85`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/templates/repo/settings/webhook/history.tmpl#L75-L85)), so attackers can read everything the targeted internal service returns.\n\n## Impact\n\nAn authenticated user who can create or modify a webhook can:\n\n- Reach cloud metadata endpoints (AWS IMDS via NAT64 `64:ff9b::a9fe:a9fe`, Azure WireServer `168.63.129.16`)\n- Probe and exfiltrate from internal services on CGNAT (`100.64.0.0/10`) or non-RFC1918 172.x ranges\n- Read full HTTP response bodies through the webhook history UI\n\nThe same default is applied to repository migrations, broadening the attack surface to users who can trigger a migration.\n\n## Proof of Concept\n\nThe attached patch ([`gitea_ssrf_test.patch`](#patch)) adds [`TestSSRFBypassRanges`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher_test.go) to the existing test file. It uses [Go subtests](https://go.dev/blog/subtests) so each vulnerable range is its own named failing test case.\n\nRun with:\n```\ngo test -v ./modules/hostmatcher -run TestSSRFBypassRanges\n```\n\nExpected result on `4c37f4dacbac022f7beca75272439331f0368830`:\n- **8 PASS** — RFC 1918, IPv6 private ranges, and legitimate public IPs (control cases)\n- **10 FAIL** — Each failing subtest is a documented SSRF bypass\n\nSample failure output:\n```\n--- FAIL: TestSSRFBypassRanges/CGNAT_100.64.0.0/10_(RFC_6598)\n Error: Not equal: expected: false, actual: true\n Messages: ip=100.64.0.1\n--- FAIL: TestSSRFBypassRanges/Azure_WireServer_168.63.129.16\n Error: Not equal: expected: false, actual: true\n Messages: ip=168.63.129.16\n--- FAIL: TestSSRFBypassRanges/IPv6_NAT64_embedded_AWS_IMDS_169.254.169.254\n Error: Not equal: expected: false, actual: true\n Messages: ip=64:ff9b::a9fe:a9fe\n```\n\n## Suggested Remediation\n\nI'd suggest treating the design of [`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L96-L114) as the bug — `IsPrivate()` is too narrow a definition of \"internal.\" A comprehensive deny-list approach is what's needed here. For reference, CC-Tweaked's [`AddressPredicate.PrivatePattern`](https://github.com/cc-tweaked/CC-Tweaked/blob/3e7ce15ba6d5ab030092850f7e49829b64ba3555/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L169) is a good reference list, blocking each of the ranges named in the table above plus a few others (multicast, broadcast, TEST-NET, etc.).\n\nThe exact remediation is at your discretion. \n\n## References\n\n- Vulnerable function: [`modules/hostmatcher/hostmatcher.go#L96-L114`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L96-L114)\n- Default for webhooks: [`services/webhook/deliver.go#L312-L316`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/services/webhook/deliver.go#L312-L316)\n- Default for migrations: [`services/migrations/migrate.go#L522`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/services/migrations/migrate.go#L522)\n- Response captured: [`services/webhook/deliver.go#L259-L270`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/services/webhook/deliver.go#L259-L270)\n- Response rendered: [`templates/repo/settings/webhook/history.tmpl#L75-L85`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/templates/repo/settings/webhook/history.tmpl#L75-L85)\n- Go stdlib `net.IP.IsPrivate()`: <https://pkg.go.dev/net#IP.IsPrivate>\n- CC-Tweaked reference deny-list: [`AddressPredicate.java#L116-L169`](https://github.com/cc-tweaked/CC-Tweaked/blob/3e7ce15ba6d5ab030092850f7e49829b64ba3555/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L169)\n- Go subtests pattern: <https://go.dev/blog/subtests>\n- RFC 6598 (CGNAT), RFC 6052 (NAT64), RFC 4380 (Teredo), RFC 3056 (6to4), RFC 3849 (documentation)\n\n---\n\n## Patch <a name=\"patch\"></a>\n\nProposed `gitea_ssrf_test.patch`:\n\n```diff\ndiff --git a/modules/hostmatcher/hostmatcher_test.go b/modules/hostmatcher/hostmatcher_test.go\nindex c781847..0b39e60 100644\n--- a/modules/hostmatcher/hostmatcher_test.go\n+++ b/modules/hostmatcher/hostmatcher_test.go\n@@ -159,3 +159,56 @@ func TestHostOrIPMatchesList(t *testing.T) {\n \t}\n \ttest(cases)\n }\n+\n+// TestSSRFBypassRanges verifies that the \"external\" filter (the default used by\n+// webhook delivery and repository migrations) blocks dangerous IP ranges.\n+//\n+// Each subtest's `allowed` field is the expected return value of MatchHostOrIP:\n+// - false: the IP should be blocked (rejected by the filter)\n+// - true: the IP should be allowed (a legitimate public destination)\n+//\n+// Subtests that FAIL are documented SSRF bypasses: IP ranges that should be\n+// blocked but are incorrectly allowed because the underlying check relies on\n+// net.IP.IsPrivate(), which only covers RFC 1918 and RFC 4193.\n+func TestSSRFBypassRanges(t *testing.T) {\n+\ttype tc struct {\n+\t\tip net.IP\n+\t\tallowed bool\n+\t}\n+\n+\thl := ParseHostMatchList(\"\", \"external\")\n+\n+\tcases := map[string]tc{\n+\t\t// RFC 1918 / IPv6 private ranges - correctly blocked\n+\t\t\"RFC1918 10.0.0.0/8\": {net.ParseIP(\"10.0.0.1\"), false},\n+\t\t\"RFC1918 172.16.0.0/12\": {net.ParseIP(\"172.16.0.1\"), false},\n+\t\t\"RFC1918 192.168.0.0/16\": {net.ParseIP(\"192.168.1.1\"), false},\n+\t\t\"IPv6 loopback ::1\": {net.ParseIP(\"::1\"), false},\n+\t\t\"IPv6 link-local fe80::/10\": {net.ParseIP(\"fe80::1\"), false},\n+\t\t\"IPv6 ULA fd00::/8\": {net.ParseIP(\"fd00::1\"), false},\n+\n+\t\t// Legitimate public IPs - correctly allowed\n+\t\t\"Public IPv4 (Google DNS)\": {net.ParseIP(\"8.8.8.8\"), true},\n+\t\t\"Public IPv6 (Google DNS)\": {net.ParseIP(\"2001:4860:4860::8888\"), true},\n+\n+\t\t// SSRF bypasses - the assertions below intentionally describe the\n+\t\t// expected secure behavior (allowed=false). Each failing subtest is\n+\t\t// a documented bypass.\n+\t\t\"CGNAT 100.64.0.0/10 (RFC 6598)\": {net.ParseIP(\"100.64.0.1\"), false},\n+\t\t\"CGNAT 100.127.255.254 (RFC 6598)\": {net.ParseIP(\"100.127.255.254\"), false},\n+\t\t\"Azure WireServer 168.63.129.16\": {net.ParseIP(\"168.63.129.16\"), false},\n+\t\t\"Non-RFC1918 172.32.0.0/11\": {net.ParseIP(\"172.32.0.1\"), false},\n+\t\t\"Non-RFC1918 172.45.0.0/16\": {net.ParseIP(\"172.45.0.1\"), false},\n+\t\t\"IPv6 NAT64 64:ff9b::/96 (RFC 6052)\": {net.ParseIP(\"64:ff9b::1\"), false},\n+\t\t\"IPv6 NAT64 embedded AWS IMDS 169.254.169.254\": {net.ParseIP(\"64:ff9b::a9fe:a9fe\"), false},\n+\t\t\"IPv6 Teredo 2001::/32 (RFC 4380)\": {net.ParseIP(\"2001::1\"), false},\n+\t\t\"IPv6 6to4 2002::/16 (RFC 3056)\": {net.ParseIP(\"2002::1\"), false},\n+\t\t\"IPv6 documentation 2001:db8::/32 (RFC 3849)\": {net.ParseIP(\"2001:db8::1\"), false},\n+\t}\n+\n+\tfor name, c := range cases {\n+\t\tt.Run(name, func(t *testing.T) {\n+\t\t\tassert.Equalf(t, c.allowed, hl.MatchHostOrIP(\"\", c.ip), \"ip=%v\", c.ip)\n+\t\t})\n+\t}\n+}\n```\n\n## Credit\n\nThis vulnerability was uncovered by @JLLeitschuh of the @braze-inc security team.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.gitea.io/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.26.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22874"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/go-gitea/gitea/pull/38059"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/go-gitea/gitea/pull/38173"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4"
58+
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/go-gitea/gitea"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.3"
66+
}
67+
],
68+
"database_specific": {
69+
"cwe_ids": [
70+
"CWE-918"
71+
],
72+
"severity": "CRITICAL",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-07-21T20:27:17Z",
75+
"nvd_published_at": "2026-07-03T21:16:57Z"
76+
}
77+
}

‎advisories/github-reviewed/2026/07/GHSA-rjvx-x5h2-6px5/GHSA-rjvx-x5h2-6px5.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rjvx-x5h2-6px5",
4+
"modified": "2026-07-21T20:26:37Z",
5+
"published": "2026-07-21T20:26:37Z",
6+
"aliases": [],
7+
"summary": "Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions",
8+
"details": "### Summary\n\nThe API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints.\n\nWhen a repository is forked into an organization through the API, the endpoint only verifies that the user is an organization member (`IsOrgMember()`), but does not verify whether the user is allowed to create repositories in that organization (`CanCreateOrgRepo()`).\n\nAs a result, organization members belonging to teams with `can_create_org_repo=false` can still create repositories inside the organization by using the fork API.\n\n### Details\n\nAffected endpoint:\n\n```\nPOST /api/v1/repos/{owner}/{repo}/forks\n```\n\nIn `routers/api/v1/repo/fork.go`, the endpoint performs the following authorization check:\n\n```go\nif !ctx.Doer.IsAdmin {\n isMember, err := org.IsOrgMember(ctx, ctx.Doer.ID)\n if !isMember {\n ctx.APIError(http.StatusForbidden, ...)\n return\n }\n}\n```\n\nThe equivalent web UI implementation uses the stronger permission check:\n\n```go\nisAllowedToFork, err := organization.OrgFromUser(ctxUser).\n CanCreateOrgRepo(ctx, ctx.Doer.ID)\n```\n\nThe same `CanCreateOrgRepo()` authorization check is also used by:\n\n* CreateOrgRepo API endpoint\n* GenerateRepository API endpoint\n\nThe fork endpoint appears to be the only repository creation path that relies solely on organization membership.\n\n### Proof of Concept\n\nTested on Gitea 1.23.7.\n\n1. Create an organization.\n2. Create a team with `can_create_org_repo=false`.\n3. Add a test user to that team.\n4. Verify that normal repository creation is denied:\n\n```http\nPOST /api/v1/orgs/target-org/repos\n```\n\nResult:\n\n```http\n403 Forbidden\n```\n\n5. Fork a repository into the organization:\n\n```http\nPOST /api/v1/repos/admin/public-repo/forks\nContent-Type: application/json\n\n{\n \"organization\": \"target-org\"\n}\n```\n\nResult:\n\n```http\n202 Accepted\n```\n\nThe repository is successfully created despite repository creation permissions being disabled.\n\n### Impact\n\nUsers who are organization members but are intentionally prevented from creating repositories can bypass that restriction through the API.\n\nThis allows unauthorized repository creation inside the organization and may expose additional attack surface depending on the organization's Actions, runner, and workflow configuration.\n\nThe vulnerability represents an authorization bypass because API behavior is less restrictive than both the web UI and other repository creation endpoints.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "code.gitea.io/gitea"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.26.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rjvx-x5h2-6px5"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/go-gitea/gitea/pull/36950"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/go-gitea/gitea/commit/686d10b7f0c26baf91171124b382cbcdfa7bf025"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/go-gitea/gitea"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.0"
56+
}
57+
],
58+
"database_specific": {
59+
"cwe_ids": [
60+
"CWE-863"
61+
],
62+
"severity": "MODERATE",
63+
"github_reviewed": true,
64+
"github_reviewed_at": "2026-07-21T20:26:37Z",
65+
"nvd_published_at": null
66+
}
67+
}

0 commit comments

Comments
 (0)