OpenID Discovery SSRF in Gitea

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Gitea's OpenID authentication feature. When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An attacker can cause the server to contact loopback or private-network HTTP services, exposing internal service behavior and enabling interaction with otherwise unreachable resources.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected HTTP requests originating from your Gitea server, especially to localhost or private IP ranges. Check Gitea logs for OpenID-related requests to unusual destinations. Use tools like tcpdump or Wireshark to capture outbound connections from the Gitea process.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker could exploit this to send arbitrary HTTP requests to internal network services. This enables port scanning, service fingerprinting, and bypassing network security controls. Attackers could target localhost-only resources or internal services, potentially accessing sensitive data or services not directly exposed to the internet.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily enables SSRF attacks, allowing unauthenticated attackers to interact with internal network services. While not directly violating GDPR or HIPAA, it could lead to unauthorized access to sensitive data or systems, potentially violating principles of data protection and security required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Gitea to version 1.27.0 or later to apply the security patch.
• Disable OpenID authentication if not required, as it is now disabled by default in patched versions.
• Implement network-level restrictions to block outbound connections from the Gitea server to sensitive addresses.

Useful 0 Not Useful 0