Forgejo Patches Critical Remote Code Execution Vulnerability

The Forgejo project, which develops the software forge of the same name (an open-source counterpart to collaborative development platforms), has announced the release of versions 16.0.4 and 15.0.8. The updates fix two vulnerabilities, one of which is rated critical and allows remote execution of arbitrary code (RCE).

How the Attack Works

The problem lies in the mechanism for creating a new repository based on a template. During this operation, Forgejo clones the template repository, removes its .git folder, performs variable substitution in the files listed in .forgejo/template, and then initializes a new git repository.

The window for an attack opens precisely at the variable-substitution step. An attacker can craft a template so that a new .git folder appears in the directory during this processing. When git is subsequently initialized, it picks up and adopts this folder as its own — with all the consequences that entails.

As a result, a malicious template repository makes it possible to read arbitrary data on the Forgejo host and launch arbitrary processes on it — in other words, to carry out a full-fledged remote code execution attack.

What Was Fixed

The cure turned out to be straightforward: now, after variable substitution is complete, Forgejo removes any existing .git folder from the directory — and only then initializes the new repository. This way, the directory planted by the attacker never gets a chance to come under git's control.

The project strongly urges administrators to update to the current versions as soon as possible.

Source: LWN.net