An unauthenticated attacker can read any file the service account has access to on Gitea, a self-hosted Git platform from versions 1.22.1 through 1.27.0. Gitea indicates it could lead to command injection if an attacker reads the `app.ini` file, extracts the `INTERNAL_TOKEN`, injects a Git hook via the internal logger, and triggers that hook during an anonymous clone. If logs indicate that the markup endpoint was accessed on an affected build, treat readable credentials for the Gitea service account as compromised and rotate internal tokens, OAuth materials, JWT signing keys, and database passwords before declaring the instance clean.
An anonymous request bypasses that check for any public repository with code unit enabled, effectively exposing an unauthenticated attack path through this endpoint in instances without public repositories. The new callback used by go-org is ioutil.ReadFile, which allows an attacker to include files that the service account can access through Org-mode's #+INCLUDE directive when using Mode: file. Administrators should verify their systems for any unauthorized access or vulnerabilities that were recently discovered by XBOW Security's autonomous offensive security tool and independently reported by Shai Rod, better known as NightRang3r.
A vulnerability emerged in the Gitea security updates from June, where threat actors attempted to bypass authentication on Docker images after discovering an issue that had been addressed just a few days prior.
