BaseFortify

Executive Summary

This vulnerability in Gitea's web installer allows an attacker to gain administrative access without a password if the installer is accessible on a database that already has users. When the install form is submitted with an administrator username matching an existing account, it creates an authenticated session for that account without verifying the password. If the account is an administrator, this grants full administrative privileges, including the ability to change the account's password.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea logs for repeated admin session creation attempts without password verification. Inspect database for users with admin privileges created during unexpected reinstallation events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an unauthorized attacker to gain full control over a Gitea instance if they can access the web installer on a database with existing users. This includes resetting passwords, modifying configurations, or accessing sensitive data stored in the repository.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially lead to unauthorized administrative access if an attacker exploits it to gain full control over a Gitea instance. This may impact compliance with GDPR or HIPAA if sensitive data is exposed or altered without proper authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Set INSTALL_LOCK to true in Gitea configuration to prevent reinstallation. Verify admin accounts and reset passwords for any accounts that may have been compromised during the vulnerability window.

Useful 0 Not Useful 0