Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)
21 points by brn
21 points by brn
This git endpoint is seeing a high influx of requests for this repository, to preserve the availability of Codeberg your search request will not be processed. Sorry for the inconvenience and please try again later.
That's something I haven't seen before. This URL works:
I love Forgejo, but I also feel like git forges are huge attack surfaces, and wonder why we don't take more hardened approaches to building them from the start, when the expectation is public-facing.
Do you have a specific hardened design in mind?
It may be prudent to separate and isolate the actual git repositories, packages and of course CI from the project management features like issues and merge requests (that can be implemented as a standard web app).
Stupid scrapers are a major pain for public git forges right now, a radical change to reduce the surface would be to only offer git clone but no web view of the code (at leas to unauthenticated users).
Anything involving working with a checked out tree on disk with git is a minefield. A more hardened approach would be constructing the template tree directly via libgit2
Same as any other project probably. I'm sure the developers don't try to ship insecure code, but they are time limited and generally focused on feature work.
PR: Critical: fix: prevent template expansion from interfering with git repo initialization. When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in .forgejo/template, and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new .git folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing .git folder is removed from the directory before the git repository is initialized.
First of all: would an attacker need to have write access to the template repository to launch this attack?
Secondly: isn't that access something that would be limited to admins anyways?
would an attacker need to have write access to the template repository
An ordinary user that can create a repository can turn it into a template (at least on Codeberg).
A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack.
You can now use your own template repository to gain code execution on the host.
The title here says Forgejo 16, but it also affects the current LTS release 15: https://codeberg.org/forgejo/security-announcements/issues/59