CVE-2021-29134

Vulnerability

The avatar middleware in Gitea before version 1.13.6 is vulnerable to directory traversal. An attacker can craft a URL that allows traversal outside the intended avatar directory, leading to arbitrary file read [1][3]. The vulnerability is present in the avatars handler and specifically the getAvatar function [3]. Versions prior to 1.13.6 are affected [1][4].

Exploitation

An attacker needs network access to the Gitea instance and the ability to send a crafted HTTP request. No authentication is required if the avatar endpoint is publicly accessible. The attacker constructs a URL with path traversal sequences (e.g., ../) to access files outside the avatar storage directory [3]. The fix in pull request #15125 removed the use of filepath.Join with user-supplied path components, which was the root cause [3].

Impact

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server file system, potentially including configuration files, database credentials, or other sensitive data. This is a confidentiality impact with high severity (CVSS 7.5) [3].

Mitigation

Gitea version 1.13.6, released on March 15, 2022, contains the fix for this vulnerability [1][4]. Users should upgrade to at least version 1.13.6 or later. There is no known workaround other than upgrading [3].