Patchfirst
Patchfirst
CVE-2020-14144 Public exploit EPSS 95.4%

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer…

Summary

The git hook feature in Gitea versions 1.1.0 through 1.12.5 is flagged as a possible remote code execution issue, though the vendor disputes that it is a vulnerability and says the feature is intentionally available only to a narrow set of accounts. Per the report, an authenticated user could potentially run arbitrary code on the server in customer environments where the risks of the git hook feature were not properly understood, which the vendor says is not a flaw in the product.

Official description · CVE.org

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.

Breakdown
26.7 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 9 days before disclosure.

  1. Public exploit codeMetasploit9 days before
  2. Disclosedday 0

7 fixes in code.gitea.io/gitea over 3 years. The latest fix listed for code.gitea.io/gitea is 1.13.6.

Fixes in code.gitea.io/giteaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.8.0CVE-2019-1157628 Apr 2019
  2. 1.11.2CVE-2021-453278 Feb 2022
  3. 1.12.0CVE-2020-1324620 May 2020
  4. 1.12.6CVE-2020-1414416 Oct 2020
  5. 1.13.2CVE-2021-33825 Feb 2021
  6. 1.13.4CVE-2021-2837815 Mar 2021
  7. 1.13.6CVE-2021-2913415 Mar 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: code.gitea.io/gitea.

Gocode.gitea.io/giteaGHSA-3h6c-c475-jm7v

Upgrade to 1.26.3

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2022-30781, CVE-2026-20896).

Still affected on this line by CVE-2026-60004 (no fix published).

Gogo get code.gitea.io/gitea@v1.26.3

First fixed in 1.12.6 for CVE-2020-14144.

Affected versions

If you runUpgrade to
1.1.0 up to 1.12.61.26.3first fix for this CVE: 1.12.6

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 5 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

7 links, grouped by NVD tag (1 duplicate merged)

x_refsource_MISC 7

github.com/go-gitea/gitea/releasesfzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/github.com/go-gitea/gitea/pull/13058docs.gitlab.com/ee/administration/server_hooks.htmldocs.github.com/en/enterprise-server%402.19/admin/policies/creating-a-pre-receive-hook-scriptpacketstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.htmlgithub.com/PandatiX/CVE-2021-28378
↑ ↓ chooseEnter openEsc close