CVE-2021-45328

Vulnerability

Gitea versions prior to 1.4.3 are vulnerable to an open redirect attack through internal URLs. The flaw exists because the application does not properly validate destination URLs when processing certain internal links, such as those used to view repository files. This allows an attacker to craft a link that appears to be internal but redirects to an arbitrary external site [3].

Exploitation

An attacker can exploit this by constructing a malicious URL that leverages internal routes (e.g., those involving symlinks that point outside the repository) to redirect users to an untrusted external domain. The attack requires no authentication and only relies on user interaction, such as clicking on the crafted link [3].

Impact

Successful exploitation enables an attacker to redirect victims to any external website, facilitating phishing attacks or credential theft. The impact is limited to social engineering; no direct code execution or data compromise is possible [3].

Mitigation

The vulnerability was fixed in Gitea version 1.4.3, released in June 2018. Users should upgrade to this version or later immediately [2]. No workarounds are available for affected versions.