Token Spoofing via SSH Key Registration in Gitea

Executive Summary

Gitea has a vulnerability where a token with write:user scope can be used to register an attacker-controlled SSH public key on the token owner's account. This allows the attacker to use the corresponding private key to sign API requests, bypassing token scope checks and gaining unscoped API access while retaining the account's normal permissions.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea logs for unusual SSH key additions via the POST /api/v1/user/keys endpoint. Review HTTP Signature authentication attempts in access logs. Verify if any tokens with write:user scope have been used to register new SSH keys.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to your Gitea account, perform actions on your behalf, or access sensitive data. The impact is limited only by your account's existing role and repository permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized API access by bypassing token scope checks, which could lead to unauthorized data access or modification. For GDPR, this may violate principles of data protection and user consent. For HIPAA, it risks exposing protected health information if repository permissions are misused.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.2 or later. Revoke and regenerate all tokens with write:user scope. Monitor for unauthorized SSH key additions and HTTP Signature authentication attempts.

Useful 0 Not Useful 0