CVE-2019-11228

Vulnerability

The vulnerability exists in repo/setting.go where the MirrorAddress field from the form is passed directly to SaveAddress without any validation. This allows an attacker to set an arbitrary URL as the mirror address for a repository [1].

Exploitation

An attacker with repository administration privileges can modify the mirror settings to point to an attacker-controlled server. The lack of validation means no checks are performed on the URL scheme, host, or path before saving [1][2].

Impact

When the mirror is updated, the Gitea instance will connect to the attacker-specified URL, potentially enabling server-side request forgery (SSRF), data exfiltration, or other network-based attacks [1].

Mitigation

The issue was patched in Gitea version 1.7.6 and version 1.8-RC3. Users should upgrade to these or later versions to protect their installations [2][3][4].