CVE-2021-45325

Vulnerability

A Server Side Request Forgery (SSRF) vulnerability exists in Gitea before version 1.7.0 when using OpenID URLs. If no WHITELIST_URIS or BLACKLIST_URIS are configured in the openid section of app.ini, the raw error message from a failed OpenID request may reveal sensitive information about the local network [2][3][4].

Exploitation

An attacker can provide a malicious OpenID URL to a Gitea instance. If the server attempts to fetch that URL and the request fails (e.g., due to a connection timeout or invalid response), the raw error message is displayed in the UI, potentially leaking internal network details. No authentication is required to trigger this behavior [3][4].

Impact

Successful exploitation results in information disclosure. The attacker can gain knowledge about the internal network structure, services, and potentially other sensitive data through the error messages [2].

Mitigation

Upgrade to Gitea version 1.7.0 or later, which was released in January 2019 and includes a fix that hides the raw error and logs it instead [3][4]. As a workaround, administrators can set WHITELIST_URIS or BLACKLIST_URIS in the openid section of app.ini to restrict allowed OpenID providers [3].