Gitea LFS Deploy-Key Privilege Escalation

Executive Summary

This is a privilege escalation vulnerability in Gitea's Large File Storage (LFS) component affecting versions up to 1.25.5. It involves improper handling of deploy keys, which are meant for limited repository access. When used via SSH, Gitea incorrectly embeds the repository owner's UserID into the LFS JWT instead of the deploy key's identity. This allows an attacker with a write deploy key to impersonate the repository owner for cross-repository LFS operations.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea version with 'gitea --version' or inspect the web interface footer. Look for unauthorized LFS object access in logs or audit trails. Review deploy keys in repositories for unexpected or excessive permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exfiltrate LFS objects from any private repository owned by the victim, including those they administer. If the victim is a site administrator, the attacker gains access to all LFS objects across the entire Gitea instance. The exploit requires knowledge of the SHA-256 OID of a specific LFS object, which may be obtained through public forks or shared data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data stored in Gitea LFS repositories. If exploited, attackers may exfiltrate private repository content, including personal or health information, violating data protection requirements for confidentiality and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.25.6 or later. Temporarily disable LFS cross-repository access by modifying services/lfs/server.go to remove the shortcut. Audit and revoke unnecessary deploy keys across all repositories.

Useful 0 Not Useful 0