Branch Protection Bypass in GitHub via PR Retargeting

Executive Summary

This vulnerability allows an attacker with write access to bypass branch protection rules in Gitea. It works by exploiting how approvals are handled when a pull request's target branch is changed. The attacker gets an official approval on a PR targeting an unprotected branch, then retargets it to a protected branch. The approval's official flag remains valid even though it should be reevaluated for the protected branch, allowing unauthorized merges.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea server logs for unusual PR retargeting events where approvals persist after branch changes. Review repository settings for protected branches and verify if official approval flags are reevaluated when PR targets change. No specific commands are provided in the advisory.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized code merges into protected branches like master. This may lead to privilege escalation, unauthorized changes in the codebase, or potential introduction of malicious code. Attackers only need write access and the ability to create pull requests, making it a significant risk for repositories with branch protection enabled.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.26.4 or later to address the vulnerability. Review and update branch protection rules to ensure approvals are reevaluated when PR targets change. Monitor PR activities for unauthorized retargeting attempts.

Useful 0 Not Useful 0