CVE-2022-30781: Gitea XSS Vulnerability

CVE-2022-30781 Overview

CVE-2022-30781 affects Gitea versions before 1.16.7. The application fails to escape the remote parameter passed to git fetch, allowing an authenticated attacker to inject arbitrary command-line options. This improper output neutralization [CWE-116] enables remote code execution on the Gitea server. The flaw impacts integrity but not confidentiality or availability according to the CVSS vector. Public exploits for this issue have been published on Packet Storm Security, and the EPSS percentile of 99.158 indicates a high probability of exploitation activity relative to other CVEs.

Critical Impact

Attackers can execute arbitrary code on the Gitea server by submitting a crafted remote URL that is passed unescaped to git fetch.

Affected Products

• Gitea versions prior to 1.16.7
• Self-hosted Gitea instances exposing repository mirroring or fetch functionality
• Container and binary deployments of Gitea on any supported platform

Discovery Timeline

• 2022-05-16 - CVE-2022-30781 published to the National Vulnerability Database
• 2022-05 - Gitea 1.16.7 released with the fix in pull requests #19487 and #19490
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-30781

Vulnerability Analysis

The vulnerability resides in how Gitea constructs git fetch commands when interacting with remote repositories. The remote URL value supplied through Gitea is concatenated into the git command line without proper escaping or argument separation. Because git supports option arguments that begin with a dash, a remote string crafted to look like an option (rather than a URL) is interpreted by git as a flag. Several git options accept file paths or external helper specifications that can execute code. The result is a command injection chain that runs under the Gitea service account on the host. The fix introduces explicit argument termination and validation of remote inputs before they reach the git subprocess.

Root Cause

The root cause is improper output neutralization for downstream components [CWE-116]. Gitea trusted the structure of the remote string when assembling the git invocation, and it did not insert -- to terminate option parsing or sanitize values beginning with -. Any caller that could set a remote could therefore smuggle git options into the executed process.

Attack Vector

The attack vector is network-based and requires the attacker to reach a Gitea workflow that triggers git fetch against an attacker-controlled remote. Mirror configuration, repository migration, and pull-mirror refresh paths have been cited in public proof-of-concept exploits. Once the malicious remote is fetched, the injected git option causes git to execute attacker-supplied logic, yielding code execution on the Gitea host. Detailed exploitation steps are documented in the Packet Storm Gitea 1.16.6 Remote Code Execution advisory and the Packet Storm Gitea Git Fetch Remote Code Execution advisory.

No verified exploit code is reproduced here. Refer to the linked advisories for technical proof-of-concept details.

Detection Methods for CVE-2022-30781

Indicators of Compromise

• Repository mirror or remote configurations where the remote URL begins with a dash character (for example, values starting with --upload-pack= or -u).
• Unexpected child processes spawned by the Gitea binary, particularly shells, interpreters, or network utilities launched from git fetch operations.
• Outbound network connections from the Gitea host to unfamiliar destinations correlated with mirror refresh events.

Detection Strategies

• Review the Gitea database mirror and repository tables for remote URLs containing leading hyphens or shell metacharacters.
• Inspect Gitea application logs for failed or anomalous fetch operations, especially against externally provided remotes.
• Correlate Gitea process telemetry with git subprocess command lines to identify option injection patterns.

Monitoring Recommendations

• Enable process command-line auditing on the Gitea host and alert when git is invoked with suspicious option values traced back to the Gitea parent process.
• Forward Gitea access and action logs to a centralized SIEM and create rules that flag repository migration and mirror creation events from low-trust accounts.
• Baseline outbound traffic from the Gitea server and alert on deviations during mirror sync windows.

How to Mitigate CVE-2022-30781

Immediate Actions Required

• Upgrade Gitea to version 1.16.7 or later as published in the Gitea 1.16.7 release announcement.
• Audit existing repositories and mirrors for malicious remote URLs and remove or rewrite any values beginning with a dash.
• Restrict repository creation, migration, and mirror configuration to trusted users until the patch is applied.

Patch Information

The issue is fixed in Gitea 1.16.7. The relevant code changes are in GitHub Pull Request #19487 and GitHub Pull Request #19490, which add input validation and explicit argument separation when invoking git. Administrators should apply binary, container, or package upgrades depending on the deployment method.

Workarounds

• Disable repository migration and mirroring features for non-administrative users if patching cannot be performed immediately.
• Place Gitea behind an authenticated reverse proxy and limit network egress from the Gitea host to known git endpoints.
• Run the Gitea service under a least-privileged account with no shell access to limit the impact of successful injection.

# Verify the running Gitea version is patched
gitea --version
# Expected output: Gitea version 1.16.7 or newer