Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in a common Git service, allowing unauthorized users to gain access to accounts, including administrator privileges, by exploiting a flaw in how external identities are linked during sign-up. This issue could potentially compromise sensitive code repositories and user data if the affected feature is enabled.
- Attackers can hijack accounts via external sign-in.
- Access to code and user data is at risk.
- Confirm if automatic account linking is enabled.
Attack Path
How an attacker could exploit the issue
An attacker who has an account with a configured OAuth2 provider can exploit this vulnerability to gain unauthorized access to other users' Gitea accounts. By submitting another user's username or email during the account linking process, the attacker can associate their external identity with the victim's Gitea account. This allows the attacker to sign in as the victim, potentially gaining administrator privileges, without needing the victim's password. The compromised link remains active for subsequent sign-ins.
- Attacker needs an OAuth2 account.
- Submits attacker-controlled identity during linking.
- Unauthorized access and account takeover.
Live Threat
Current exploitation, exposure, and threat context
When the `ACCOUNT_LINKING` setting is configured to `auto` and registration is enabled, an attacker could impersonate a legitimate user, including administrators, by linking their external identity to a Gitea account without needing the user's password. This allows the attacker to gain unauthorized access to the user's account, with the linked account persisting for future sign-ins.
- User accounts and administrator access.
- Linking external identity to a Gitea account.
- Unauthorized access to account data and actions.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts self-hosted Git services, likely requiring action from platform or application owners. The first step is to inventory where the affected technology is deployed, assess its internet reachability and criticality, and identify the specific accountable owner before planning remediation.
- Platform or application owners should lead.
- Verify external access and business criticality.
- Plan remediation considering vendor coordination.
