The Forgejo software-forge project has released versions 16.0.4 and 15.0.8 to address a critical security vulnerability that could allow for remote code execution (RCE). The vulnerability stemmed from how Forgejo handles template repositories during new repository creation.
Specifically, when a new repository is generated from a template, Forgejo clones the template, removes the .git folder, expands variables in files within the .forgejo/template directory, and then initializes a new git repository. The flaw allowed malicious actors to exploit the variable template expansion process to recreate a .git folder. This would then be adopted by git during the new repository’s initialization.
According to the project, a malicious template repository could be used to read arbitrary data from the Forgejo host and execute arbitrary processes on the host, resulting in a remote code execution attack. The fix implemented in versions 16.0.4 and 15.0.8 removes any existing .git folder after variable expansion but before git repository initialization.
The Forgejo project recommends that users upgrade to the latest version as soon as possible to mitigate the risk.
Originale Berichterstattung lesen
💬 Kommentare
📜 Kommentar-Richtlinie