Hackers Are Attacking a Critical Vulnerability in the Gitea Docker Image

Security researchers have observed active exploitation of a critical vulnerability in the official Docker image of Gitea — a popular self-hosted service for managing Git repositories.

The gist of the problem

The vulnerability lets attackers bypass the authentication mechanism and impersonate any user of the system, including administrators. This gives attackers access to private repositories, server settings and other confidential data stored in a Gitea instance.

Who is at risk

At risk are organizations and developers who have deployed Gitea using the official Docker image. Because Gitea is often used as a standalone alternative to GitHub and GitLab for storing source code, successful exploitation of the vulnerability could lead to leaks of intellectual property and the compromise of software supply chains.

What administrators should do

Administrators using the Gitea Docker image are advised to check the version of their deployed service as soon as possible and update it to the patched version. It is also worth reviewing access logs for suspicious activity that could indicate a possible account compromise.

Active exploitation of the vulnerability in the wild underscores the importance of applying security updates promptly to the infrastructure used for storing and managing source code.

Source: Bleeping Computer