CVE-2019-11229

Vulnerability

Details CVE-2019-11229 is a remote code execution vulnerability in Gitea, an open-source Git hosting solution, affecting versions before 1.7.6 and 1.8.x before 1.8-RC3. The flaw resides in models/repo_mirror.go, where mirror repository URL settings are improperly handled [2]. This allows an attacker to inject arbitrary Git configuration options that can lead to command execution.

Exploitation

To exploit the vulnerability, an attacker must have authenticated access to Gitea with administrative privileges over a repository, specifically the ability to modify mirror settings. By crafting a malicious URL containing Git config directives (e.g., --upload-pack), the attacker can execute arbitrary commands on the Gitea server during mirror operations [1][3]. Public exploit code exists, demonstrating the attack vector [3].

Impact

Successful exploitation grants the attacker remote code execution on the server running Gitea, potentially leading to full compromise of the application and its underlying system. The vulnerability is classified as critical (CVSS v3 base score 9.0) [2].

Mitigation

The vulnerability is fixed in Gitea versions 1.7.6 and 1.8-RC3 and later [4]. Users are strongly advised to upgrade immediately. No workarounds are available for unpatched versions.