Webhook Exfiltration in GitHub After Access Revocation

Executive Summary

This vulnerability in Gitea allows webhooks created by a collaborator with admin permissions to keep firing even after their repository access is revoked. The issue occurs because the system fails to remove or disable these webhooks during the revocation process in the DeleteCollaboration function. As a result, the former collaborator can continue receiving real-time exfiltration of private repository content indefinitely.

Useful 0 Not Useful 0

Detection Guidance

Check for active webhooks in Gitea repositories by running: curl -s -H 'Authorization: token YOUR_TOKEN' 'https://YOUR_GITEA_URL/api/v1/repos/OWNER/REPO/hooks' | jq '.[] | {id, url, active}'

Review logs for unexpected data exfiltration attempts or unusual webhook activity targeting external URLs.

Audit collaboration access regularly to ensure no stale collaborators remain with active webhooks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized individuals to continuously receive sensitive data from private repositories, including issue titles, bodies, and commit information. It enables ongoing data exfiltration without detection, posing risks to confidentiality and data integrity for organizations using affected Gitea versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations such as GDPR and HIPAA by enabling unauthorized access and exfiltration of sensitive data. Organizations may face legal penalties, reputational damage, and loss of trust due to failure to protect private repository content.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later to apply the patch that fixes the incomplete revocation cleanup.

Manually review and disable any webhooks created by revoked collaborators in all repositories.

Re-validate all active webhooks to ensure they are authorized and necessary.

Useful 0 Not Useful 0