Remote Code Execution Vulnerability in Gitea by Go-Gitea
CVE-2022-30781

7.5HIGH

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
16 May 2022

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 84%

What is CVE-2022-30781?

Gitea versions prior to 1.16.7 are susceptible to a remote code execution vulnerability caused by the improper escaping of the git fetch command's remote parameter. This flaw enables an attacker to execute arbitrary code on the server by crafting a malicious request. It is crucial for users of Gitea to upgrade to version 1.16.7 or later to mitigate this serious security risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2022-30781
Created by Rapid7

CVE-2022-30781
Created by wuhan005

References

https://github.com/go-gitea/gitea/pull/19490
https://github.com/go-gitea/gitea/pull/19487
https://blog.gitea.io/2022/05/gitea-1.16.7-is-released/

EPSS Score

84% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2022-30781 : Remote Code Execution Vulnerability in Gitea by Go-Gitea