New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
A new remote code execution (RCE) vulnerability has been disclosed in Gitea, the self-hosted Git service. According to The Hacker News, the flaw enables any user with write access to a repository to plant a Git hook that can execute arbitrary shell commands. Git hooks are scripts that run automatically on certain Git events, such as commits or pushes. By crafting a malicious hook, an attacker with repository write permissions could execute shell commands on the Gitea server. This could lead to full compromise of the host system, including data theft, service disruption, or lateral movement within the network. The vulnerability underscores the risk of granting write access to untrusted users in Gitea instances. The source does not provide a CVE ID, specific version range, or remediation steps.
Repository write access can lead to full server compromise via Git hooks.